Threats tagged 'ghsa-fj72-5ch7-35jh'

FreeRDP versions before 3.32.2 contain a use-after-free vulnerability in the client's rdpgfx dynamic virtual channel. This occurs when a duplicate-name channel with a new ChannelId overwrites the listener's callback slot, which is freed without being cleared. A malicious RDP server can exploit this by opening and closing such a channel, then sending data on the original channel to crash the client or potentially execute arbitrary code.