FreeRDP AUDIN Format Renegotiation Use-After-Free Vulnerability

A heap-use-after-free vulnerability has been identified in FreeRDP versions prior to 3.22.0. The issue arises in the AUDIN channel when format renegotiation occurs. The active format list is freed while the capture thread continues to use a pointer to the freed memory, leading to a use-after-free condition in the 'audio_format_compatible' function. This vulnerability can be exploited by a malicious server, causing a client-side crash and potential heap corruption, with a risk of code execution depending on the allocator's behavior and the surrounding heap layout.

Impact

Exploitation of this vulnerability leads to a heap-use-after-free condition, causing a crash and potential heap corruption. This could allow for code execution, depending on the behavior of the memory allocator and the layout of the heap.

Remediation

Users can upgrade to FreeRDP version 3.22.0 or later to address this vulnerability.