{"schema":"threatline.record/2","record":{"id":"GHSA-262p-h989-vmpv","aliases":["GHSA-262p-h989-vmpv"],"summary":"Heap OOB Read in Graphics Pipeline via Unvalidated mappedWidth/mappedHeight (Android Client)","details":"### Impact\r\nOut of bounds read when using window mapped `GFX` surfaces.\r\nOnly the android client is affected.\r\n\r\n### Details\r\n\r\nWhen a surface is windowMapped via `RDPGFX_MAP_SURFACE_TO_WINDOW_PDU`, the server supplies `mappedWidth` and `mappedHeight` values (`UINT32`) that are stored in the `gdiGfxSurface` structure with no validation against the actual surface buffer dimensions:\r\n\r\n```\r\n    surface->mappedWidth = surfaceToWindow->mappedWidth;   // no bounds check\r\n\r\n    surface->mappedHeight = surfaceToWindow->mappedHeight;  // no bounds check\r\n```\r\n \r\n\r\nIn the Android client's android_UpdateWindowFromSurface, these unvalidated values control the pixel copy region:\r\n \r\n```\r\n    freerdp_image_copy((BYTE*)dst, ..., width, height,\r\n\r\n            surface->data, ..., surface->scanline, ...);\r\n```\r\n \r\n\r\nIf `mappedWidth > surface->width` or `mappedHeight > surface->height`, freerdp_image_copy reads beyond the heap allocation. The `WINPR_ASSERT` guard in `freerdp_image_copy` compiles to a no-op in release builds (`NDEBUG` defined).\r\n\r\n### Workarounds\r\nDo not use `GFX` \r\n\r\n### Credits\r\n\r\nAdiel Sol, Arad Inbar, Erez Cohen, Nir Somech, Ben Grinberg, Daniel Lubel, Shir Sadon\r\n\r\nDREAM Security Research Team","categories":["Unclassified"],"product":"aFreeRDP","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-262p-h989-vmpv","source_modified_at":"2026-10-05T20:31:02Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"ecosystem":"c","name":"aFreeRDP"},"range":"<= 3.32.0"}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-262p-h989-vmpv","source_modified_at":"2026-10-05T20:31:02Z","fetched_at":"2026-10-24T18:03:20.872036Z","package":{"ecosystem":"c","name":"aFreeRDP"},"version":"3.32.1"}],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-05T20:31:02Z","modified_at":"2026-10-05T20:31:02Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-262p-h989-vmpv","fetched_at":"2026-10-24T18:03:20.872036Z","source_modified_at":"2026-10-05T20:31:02Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-05T20:31:02Z","content_hash":"a34347e75b7560aec0f06d89fe823fdfddda3056f28a37728c3e0beaf0c65893"}}