FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
CVSS Details
- CVSS 3.1 Base Score: 4.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr | May 15, 2023 | Nov 16, 2022 |
| Alpine Linux | — | Upgrade freerdp2Upgrade freerdp | Aug 22, 2024 | Nov 16, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-libs | Feb 7, 2023 | Nov 16, 2022 |
| Centos_linux | — | Upgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade libwinpr-devel | May 15, 2023 | Nov 16, 2022 |
| Debian | — | Upgrade freerdp2 | Nov 20, 2023 | Nov 16, 2022 |
| Freebsd | — | Upgrade freerdp | Dec 25, 2022 | Dec 24, 2022 |
| Gentoo Linux | — | Upgrade net-misc/freerdp. | Jan 15, 2024 | Nov 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp | Feb 9, 2023 | Nov 16, 2022 |
| Oracle_linux | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-devel | May 18, 2023 | Nov 16, 2022 |
| Redhat_linux | — | Upgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoNo solution existsUpgrade freerdp-devel | May 15, 2023 | Nov 16, 2022 |
| Rocky_linux | — | Upgrade freerdpUpgrade libwinpr-develUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-devel | Jun 29, 2026 | Jun 25, 2026 |
| Suse | — | Upgrade freerdpUpgrade freerdp-proxyUpgrade freerdp-waylandUpgrade libfreerdp2Upgrade freerdp-develUpgrade uwac0-0-develUpgrade libwinpr2Upgrade freerdp-serverUpgrade libuwac0-0Upgrade winpr2-devel | Feb 16, 2023 | Nov 16, 2022 |
| Ubuntu | — | Upgrade libfreerdp-client2-2Upgrade libfreerdp-server2-2 | Nov 23, 2022 | Nov 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub