# Fuzzing Microsoft's RDP Client using Virtual Channels: Overview & Methodology

Stateful OOB read in RDP client RDPSND channel: shrinking the audio format list between Wave PDUs bypasses length check on wFormatNo.

- Payout: unconfirmed
- Severity: low
- Program: Microsoft
- Credited: Valentino Ricotta
- Disclosed: 2021-11-10
- Write-up quality: 8/10
- Original: https://thalium.github.io/blog/posts/fuzzing-microsoft-rdp-client-using-virtual-channels/
- Library page: https://bugbountylibrary.com/r/blog%3Athalium-github-io-blog-posts-fuzzing-microsoft-rdp-client-using-virtual-channels
- Tags: domain:desktop impact:dos kind:bounty platform:blog sev:low tech:windows technique:chained technique:fuzzing technique:source-review vuln:dos vuln:memory-corruption

**Target:** mstscax.dll CRdpAudioController::OnWaveData (RDPSND virtual channel)
**Root cause:** OnWaveData indexes savedAudioFormats with attacker-controlled wFormatNo without bounds check; the length check in OnNewFormat is only run when wFormatNo differs from lastFormatNo.
**Steps:**
1. Send a Format PDU (SERVER_AUDIO_VERSION_AND_FORMATS) advertising n>1 formats.
2. Send a Wave2 PDU (0x0D) with wFormatNo = n; client sets lastFormatNo = n.
3. Send a new Format PDU with k < n formats, freeing and rebuilding savedAudioFormats.
4. Resend the same Wave2 PDU with wFormatNo = n; OnNewFormat is skipped, OOB read at savedAudioFormats + 8*n.
**How found:** WinAFL mixed-message-type fuzzing found a non-reproducible crash on a Wave2 PDU; reversing OnWaveData showed the wFormatNo index and the lastFormatNo guard, leading to the format-list-shrink sequence to bypass OnNewFormat's check.
**Exploitation:** Only a weak comparison (wFormatTag == 1) consumes the read value, so no meaningful remote info leak; crash only.
**Insight:** When a fuzzer crash won't reproduce from a single PDU, look for a cached 'last value' guard: re-sending the same index after mutating the backing array (here via a Format PDU) skips re-validation and reaches the unchecked index.