FreeRDP Global Buffer Overflow Vulnerability in Base64 Decoding

A global buffer overflow vulnerability has been identified in FreeRDP, a free implementation of the Remote Desktop Protocol, in versions prior to 3.20.1. The issue arises from the handling of character signedness in Base64 decoding. On Arm/AArch64 builds, characters are treated as unsigned, allowing non-ASCII bytes to bypass range checks and access a global lookup table out of bounds, leading to memory corruption.

Impact

Exploitation of this vulnerability causes a client-side global buffer overflow, resulting in a crash. This vulnerability also affects the FreeRDP proxy in load-balanced server setups.

Reproduction

The vulnerability can be reproduced by using a FreeRDP client on an Arm or AArch64 platform. During the Base64 decoding process, non-ASCII bytes can be introduced in a way that exploits the signedness issue, bypassing the intended range checks and causing a global buffer overflow.

Remediation

Users can upgrade to FreeRDP version 3.20.1, where this vulnerability has been fixed.