FreeRDP integer Overflow leading to Heap Overflow

CVE-2024-22211

What is CVE-2024-22211?

The FreeRDP library, a widely-used open-source remote desktop protocol framework, is affected by a vulnerability due to an integer overflow in the freerdp_bitmap_planar_context_reset function. This flaw can lead to a heap-buffer overflow, which may allow a malicious server to manipulate memory handling in FreeRDP-based clients. Although the vulnerability does not facilitate data extraction over the network, the impact is significant as it can result in out-of-bounds read or write operations when improperly allocated buffers are used for displaying images. The issue has been resolved in versions 2.11.5 and 3.2.0, and users are recommended to upgrade promptly as there are currently no known workarounds.

References