Fuzzing Finds WARP Integer Overflow That Can Crash RDP Clients

Summary

Researchers used WTF snapshot fuzzing to find an integer-overflow bug in the Windows software rasterizer that can cause an out-of-bounds write when an RDP client processes crafted graphics data. They reported it to Microsoft; it was fixed about four months later. No PoC

Key points

• The researchers used WTF snapshot fuzzing to test how an RDP client processes RDPEGFX messages, improving the harness and experimenting with coverage methods.
• A crafted graphics update creates a surface and fills a rectangle beyond its bounds; an integer overflow in the Windows software rasterizer leads to an out-of-bounds write.
• The proof of vulnerability demonstrated a client crash triggered by a malicious RDP server under stated constraints, including no hardware acceleration and sufficient memory.
• The researchers said the flaw was in the Windows software rasterizer, not in RDP itself. They did not develop an exploit.
• They reported the bug to Microsoft’s MSRC in mid-March and said it was fixed about four months later.