Invalid offset validation leading to Out Of Bound Write in FreeRDP
Priority MEDIUM 45CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 3 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-787 and the CVSS impact.
Summary
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
EPSS 0.01535 74th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial FreeRDP (FreeRDP): 2.11.0, 3.0.0-beta3Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| FreeRDP | FreeRDP | before 2.11.0; 3.0.0-beta1 to before 3.0.0-beta3 | 2.11.0, 3.0.0-beta3 | Patch available | CNA |
- FreeRDP VendorFreeRDP Affected before 2.11.0; 3.0.0-beta1 to before 3.0.0-beta3 Fixed in 2.11.0, 3.0.0-beta3 Patch available CNA
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* | before 2.11.0 | Vulnerable | FreeRDP |
| cpe:2.3:a:freerdp:freerdp:3.0.0:beta1:*:*:*:*:*:* | 3.0.0 beta1 | Vulnerable | FreeRDP |
| cpe:2.3:a:freerdp:freerdp:3.0.0:beta2:*:*:*:*:*:* | 3.0.0 beta2 | Vulnerable | FreeRDP |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* | 37 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* | 38 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* | 39 | Vulnerable | Fedoraproject |
- cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:* Versions before 2.11.0 Vulnerable ·FreeRDP
- cpe:2.3:a:freerdp:freerdp:3.0.0:beta1:*:*:*:*:*:* Versions 3.0.0 beta1 Vulnerable ·FreeRDP
- cpe:2.3:a:freerdp:freerdp:3.0.0:beta2:*:*:*:*:*:* Versions 3.0.0 beta2 Vulnerable ·FreeRDP
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* Versions 37 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:* Versions 38 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:* Versions 39 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA FreeRDP (FreeRDP) Fixed in 2.11.0, 3.0.0-beta3
Red Hat 1 advisory
- RHSA-2024:2208 Released 2024-04-30 · Red Hat rating Moderatefreerdp security update
- Red Hat Enterprise Linux AppStream (v. 9) freerdp-2:2.11.2-1.el9, freerdp-libs-2:2.11.2-1.el9, libwinpr-2:2.11.2-1.el9
- Red Hat Enterprise Linux CRB (v. 9) freerdp-devel-2:2.11.2-1.el9, libwinpr-devel-2:2.11.2-1.el9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2024:2208 |
| Red Hat Enterprise Linux CRB (v. 9) | Fixed | RHSA-2024:2208 |
Timeline
- 2026-10-02 Threatist record created from CVE-2023-39352
References
Advisory 2
Other 4
- https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239
- https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/
More Freerdp vulnerabilities
- TI-2026-85092 Use-after-free in FreeRDP rdpgfx channel close handling CVSS 4.0CRITICAL 9.3
- TI-2026-85091 Out-of-bounds write in FreeRDP proxy via bitmap cache v2 capability CVSS 4.0CRITICAL 9.3
- TI-2026-24435 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write CVSS 3.1CRITICAL 9.8
- TI-2023-21373 Out-Of-Bounds Write in FreeRDP CVSS 3.1CRITICAL 9.8
- TI-2022-08692 Server side NTLM does not properly check parameters in FreeRDP CVSS 3.1CRITICAL 9.1
- TI-2023-21374 Out-Of-Bounds Read in FreeRDP CVSS 3.1CRITICAL 9.1
Sources
- CVE-2023-39352 · CVE Program
- CVE-2023-39352 · NVD
- FIRST EPSS
- CVE-2023-39352 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences