CVE-2020-11096

In FreeRDP before version 2.1.2, there is a global OOB read in update_read_cache_bitmap_v3_order. As a workaround, one can disable bitmap cache with -bitmap-cache (default). This is fixed in version 2.1.2.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Do not enable the +bitmap-cache option in the freerdp client. Alternatively, the bitmap-cache can be explicitly disabled with the -bitmap-cache commandline option.