FreeRDP Project

A double-free vulnerability exists in FreeRDP versions 3.x through 3.27.1 within the freerdp_client_rdp_file_apply_to_settings() function, specifically when parsing the selectedmonitors field of a .rdp connection file. An attacker can exploit this by convincing a victim to open a crafted .rdp file containing oversized monitor tokens, leading to a size-controlled double-free in FreeRDP CLI clients like xfreerdp, sdl-freerdp, or wlfreerdp. This vulnerability can result in denial of service or potentially lead to arbitrary code execution.

FreeRDP before version 3.28.0 contains a heap-based buffer overflow in the `crypto_rsa_common()` function, exploitable pre-authentication by an unauthenticated attacker crafting a malicious ciphertext to cause a denial of service on the server when a client uses RDP Standard Security.

Multiple vulnerabilities in FreeRDP allow an attacker to execute arbitrary code, bypass security controls, disclose sensitive information, tamper with data, or cause a denial-of-service, posing a high risk to systems using the software.