Summary
The five accepted advisories cover a critical transport-policy bypass, a channel-tracker underflow that can overwrite a live pointer, a server-side DRDYNVC use-after-free, disclosure of uninitialized heap bytes through RDPGFX, and smartcard response-length bugs that permit out-of-bounds reads.
The severity label follows the highest project advisory: critical, CVSS 9.3. The remaining project ratings are two high 7.5 and two moderate 6.5 findings. All five are fixed in FreeRDP 3.31.0.
Attribution and impact boundary
The project advisories directly name BynarIO Atlas and describe an automated identification and validation pipeline with human review. This page records that mixed workflow. It does not treat the transport negotiation flaw as a demonstrated successful login or characterize every issue as remote code execution; the project advisories retain their channel, configuration, build, and integration qualifications.
References
- Bynario disclosure index
- FreeRDP: transport-policy bypass (critical)
- FreeRDP: channel-tracker overwrite (high)
- FreeRDP: DRDYNVC use-after-free (high)
- FreeRDP: RDPGFX heap disclosure (moderate)
- FreeRDP: smartcard out-of-bounds reads (moderate)
Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.