Out-of-bounds Read

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol. In versions prior to 3.20.0, a vulnerability exists in FreeRDPs certificate handling code on Windows platforms. The function "freerdp_certificate_data_hash()" uses the Microsoft-specific "_snprintf" function to format certificate cache filenames without guaranteeing NUL termination when truncation occurs. According to Microsoft documentation, "_snprintf" does not append a terminating NUL byte if the formatted output exceeds the destination buffer size. If an attacker controls the "hostname" value (for example via server redirection or a crafted ".rdp" file), the resulting filename buffer may not be NUL-terminated. Subsequent string operations performed on this buffer may read beyond the allocated memory region, resulting in a Heap-based Out-of-bounds Read. In default configurations, the connection is typically terminated before sensitive data can be meaningfully exposed, but unintended memory read or a client crash may still occur under certain conditions.