Threats tagged 'ghsa-rvhh-wcgr-9gqg'

FreeRDP versions 3.0.0 up to but not including 3.32.2, when built with WITH_AAD=ON, contain a reachable assertion vulnerability. This occurs because the ARM gateway response parser improperly handles a missing or non-string redirectedServerCert field, passing a null buffer to the certificate parser. A malicious or malformed gateway response can trigger this condition, causing the client process to abort.