Summary

Out-of-bounds read and potential out-od-bounds write in access to font glyphs.

Details

Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable.

Impact

The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp runs as root.

Potentially an out-of-bounds write can follow the out-of-bounds read.

There is no denial-of-service impact, providing xrdp is running in forking mode.