High advisory for FreeRDP from 3.11.0

Advisory overview

FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.

Related references

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5j39-x36c-x9pm
• https://www.vulncheck.com/advisories/freerdp-before-3.32.2-denial-of-service-via-remotefx-rlgr-decoder