FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue.
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade freerdpUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade libwinpr-devel | May 15, 2023 | Nov 16, 2022 |
| Alpine Linux | — | Upgrade freerdpUpgrade freerdp2 | Aug 22, 2024 | Nov 16, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libwinprUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp | Feb 7, 2023 | Nov 16, 2022 |
| Centos_linux | — | Upgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp | May 15, 2023 | Nov 16, 2022 |
| Debian | — | Upgrade freerdp2 | Jul 30, 2024 | Nov 16, 2022 |
| Freebsd | — | Upgrade freerdp | Dec 25, 2022 | Dec 24, 2022 |
| Gentoo Linux | — | Upgrade net-misc/freerdp. | Jan 15, 2024 | Nov 16, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-libs | Feb 9, 2023 | Nov 16, 2022 |
| Oracle_linux | — | Upgrade freerdpUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr | May 18, 2023 | Nov 16, 2022 |
| Redhat_linux | — | Upgrade freerdpUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-libsNo solution existsUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-debugsourceUpgrade freerdp-develUpgrade freerdp-debuginfo | May 15, 2023 | Nov 16, 2022 |
| Rocky_linux | — | Upgrade freerdp-develUpgrade freerdp-libsUpgrade libwinprUpgrade freerdpUpgrade libwinpr-devel | Jun 29, 2026 | Jun 25, 2026 |
| Suse | — | Upgrade uwac0-0-develUpgrade libfreerdp2Upgrade freerdp-proxyUpgrade freerdp-waylandUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-serverUpgrade libwinpr2Upgrade libuwac0-0Upgrade winpr2-devel | Feb 16, 2023 | Nov 16, 2022 |
| Ubuntu | — | Upgrade libfreerdp-client2-2Upgrade libfreerdp-server2-2 | Nov 23, 2022 | Nov 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub