Executive brief
FreeRDP is a popular open-source remote desktop protocol (RDP) client used to connect to Windows servers and other RDP-enabled systems. A malicious RDP server can exploit an integer wraparound bug in FreeRDP's packet logging routine to read memory beyond packet boundaries, potentially crashing the client or disclosing sensitive data from memory when detailed logging is enabled.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the rdpdr_dump_packet function caused by a 32-bit unsigned integer wraparound in a bounds check. When a malicious RDP server sends a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0, the expression 16 + computerNameLen wraps to 0 in 32-bit arithmetic, bypassing the bounds guard. This causes the code to pass an attacker-controlled length (~2.1 billion) to ConvertWCharNToUtf8, which then calls _wcsnlen to scan memory looking for a null terminator, reading far past the packet buffer. The vulnerability is reachable when trace-level logging is enabled for the rdpdr logger (via -log-level:TRACE or similar flags), as the dump routine is invoked on every received RDPDR packet before any validation. FreeRDP 3.31.0 patches the issue.
Affected products
- FreeRDP Project FreeRDP before 3.31.0
Timeline
- 2026-09-01: disclosed
- 2026-09-15: advisory
- 2026-09-15: patched: Patched in version 3.31.0