Unrated severityNVD Advisory· Published Aug 31, 2023· Updated Feb 13, 2025

Out-Of-Bounds Read in FreeRDP

CVE-2023-40576

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Freerdp/Freerdpllm-fuzzy2 versions
<3.0.0-beta3+ 1 more
- (no CPE)range: <3.0.0-beta3
- (no CPE)range: >= 3.0.0-beta1, < 3.0.0-beta3
osv-coords11 versions
pkg:rpm/opensuse/freerdp2&distro=openSUSE%20Tumbleweed pkg:rpm/opensuse/freerdp&distro=openSUSE%20Leap%2015.4 pkg:rpm/opensuse/freerdp&distro=openSUSE%20Leap%2015.5 pkg:rpm/opensuse/freerdp&distro=openSUSE%20Leap%2016.0 pkg:rpm/opensuse/freerdp&distro=openSUSE%20Tumbleweed pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP4 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Package%20Hub%2015%20SP5 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP5 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2012%20SP5 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP4 pkg:rpm/suse/freerdp&distro=SUSE%20Linux%20Enterprise%20Workstation%20Extension%2015%20SP5
< 2.11.5-1.1+ 10 more
- (no CPE)range: < 2.11.5-1.1
- (no CPE)range: < 2.4.0-150400.3.23.1
- (no CPE)range: < 2.4.0-150400.3.23.1
- (no CPE)range: < 3.22.0-160000.1.1
- (no CPE)range: < 3.4.0-1.1
- (no CPE)range: < 2.4.0-150400.3.23.1
- (no CPE)range: < 2.4.0-150400.3.23.1
- (no CPE)range: < 2.1.2-12.38.1
- (no CPE)range: < 2.1.2-12.38.1
- (no CPE)range: < 2.4.0-150400.3.23.1
- (no CPE)range: < 2.4.0-150400.3.23.1

Patches

Vulnerability mechanics

References

github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/codec/include/bitmap.cmitrex_refsource_MISC
github.com/FreeRDP/FreeRDP/security/advisories/GHSA-x3x5-r7jm-5pq2mitrex_refsource_CONFIRM
security.gentoo.org/glsa/202401-16mitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000