FreeRDP Heap Use-After-Free Vulnerability in Pointer Handling

A heap-use-after-free vulnerability has been identified in FreeRDP, a free implementation of the Remote Desktop Protocol. This issue affects versions through 3.21.0. The vulnerability arises in the SDL pointer handling, where the function 'sdl_Pointer_New' frees pointer data on failure. However, the subsequent call to 'pointer_free' invokes 'sdl_Pointer_Free', which frees the data again, leading to a use-after-free condition. This vulnerability can be exploited by a malicious server, potentially causing a client-side crash and allowing for code execution under certain conditions.

Impact

Exploitation of this vulnerability causes a client-side crash and a use-after-free condition that could lead to heap corruption. Depending on the behavior of the memory allocator and the layout of the heap, this could allow for arbitrary code execution.

Remediation

Users can upgrade to FreeRDP version 3.22.0 or later to address this vulnerability.