FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocation of a buffer too small holding the data written. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdp-libsUpgrade libwinpr-develUpgrade libwinprUpgrade freerdpUpgrade freerdp-devel | May 15, 2023 | Nov 16, 2022 |
| Alpine Linux | — | Upgrade freerdpUpgrade freerdp2 | Aug 22, 2024 | Nov 16, 2022 |
| Amazon Linux Ami 2 | — | Upgrade freerdp-develUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp | Feb 7, 2023 | Nov 16, 2022 |
| Centos_linux | — | Upgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade libwinpr | May 15, 2023 | Nov 16, 2022 |
| Debian | — | Upgrade freerdp2 | Jul 30, 2024 | Nov 16, 2022 |
| Freebsd | — | Upgrade freerdp | Dec 25, 2022 | Dec 24, 2022 |
| Gentoo Linux | — | Upgrade net-misc/freerdp. | Jan 15, 2024 | Nov 16, 2022 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade freerdpUpgrade libwinpr-devel | May 18, 2023 | Nov 16, 2022 |
| Redhat_linux | — | No solution existsUpgrade libwinprUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-devel | May 15, 2023 | Nov 16, 2022 |
| Rocky_linux | — | Upgrade freerdpUpgrade freerdp-libsUpgrade libwinpr-develUpgrade libwinprUpgrade freerdp-devel | Jun 29, 2026 | Jun 25, 2026 |
| Suse | — | Upgrade freerdp-serverUpgrade freerdpUpgrade winpr2-develUpgrade libuwac0-0Upgrade libwinpr2Upgrade freerdp-proxyUpgrade libfreerdp2Upgrade freerdp-waylandUpgrade freerdp-develUpgrade uwac0-0-devel | Feb 16, 2023 | Nov 16, 2022 |
| Ubuntu | — | Upgrade libfreerdp-server2-2Upgrade libfreerdp-client2-2 | Nov 23, 2022 | Nov 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub