Allele Security Alert
Out-of-bounds write of up to 4 bytes in function nsc_rle_decode()
FreeRDP prior to version 2.0.0-rc4
Proof of concept
FreeRDP prior to version 2.0.0-rc4 contains an out-of-bounds write of up to 4 bytes in function nsc_rle_decode() that results in a memory corruption and possibly even a remote code execution.
Eyal Itkin (Checkpoint Research)
Reverse RDP Attack: Code Execution on RDP Clients
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: February 11, 2019