Threats tagged 'ghsa-wcwc-8x6v-rgcq'

FreeRDP versions 3.0.0 up to but not including 3.32.2 contain a vulnerability in the server-side RDP peer input parsing. Specifically, the server skips validation of the six-byte body of a slow-path input event with an unknown message type, failing to check if it lies within the packet's declared length. This flaw can cause an assertion failure in the WinPR stream, allowing a remote RDP client with an active session to send a truncated unknown input event that aborts assertion-enabled server processes, resulting in a denial of service.