AIKIDO-2026-862537
FreeRDP.FreeRDP is vulnerable to Out-of-bounds Read
42
Medium Risk
This Affects:
FreeRDP.FreeRDPTL;DR
The optional TSMF media redirection channel's FFmpeg decoder path parses AVC1 MPEG2VIDEOINFO media types and accepts a short nonzero ExtraData buffer without enforcing the subtype-specific minimum size. The decoder initialisation then reads fixed offsets into that buffer before checking its length, reading past the end of a short allocation. A malicious RDP server sending crafted media format data can cause a client-side heap out-of-bounds read and crash. The fix validates the source ExtraData length before reading the fixed offsets.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you enable the deprecated TSMF media redirection channel with the FFmpeg decoder.
Background info
FreeRDP.FreeRDP is vulnerable to Out-of-bounds Read in versions 0.0.1 - 3.28.0.
How to fix this
Upgrade the FreeRDP.FreeRDP library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant