FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
CVSS Details
- CVSS 3.1 Base Score: 4.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinprUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdpUpgrade libwinpr-devel | May 15, 2023 | Nov 16, 2022 |
| Alpine Linux | — | Upgrade freerdp2Upgrade freerdp | Aug 22, 2024 | Nov 16, 2022 |
| Amazon Linux Ami 2 | — | Upgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr | Feb 7, 2023 | Nov 16, 2022 |
| Centos_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdpUpgrade libwinpr-devel | May 15, 2023 | Nov 16, 2022 |
| Debian | — | Upgrade freerdp2 | Nov 20, 2023 | Nov 16, 2022 |
| Freebsd | — | Upgrade freerdp | Dec 25, 2022 | Dec 24, 2022 |
| Gentoo Linux | — | Upgrade net-misc/freerdp. | Jan 15, 2024 | Nov 16, 2022 |
| Oracle_linux | — | Upgrade freerdpUpgrade libwinprUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdp-libs | May 18, 2023 | Nov 16, 2022 |
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-libsUpgrade libwinpr-debuginfoNo solution existsUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-devel | May 15, 2023 | Nov 16, 2022 |
| Rocky_linux | — | Upgrade freerdpUpgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr | Jun 29, 2026 | Jun 25, 2026 |
| Suse | — | Upgrade libuwac0-0Upgrade freerdp-serverUpgrade libfreerdp2Upgrade freerdp-develUpgrade freerdpUpgrade winpr2-develUpgrade freerdp-waylandUpgrade uwac0-0-develUpgrade libwinpr2Upgrade freerdp-proxy | Nov 28, 2022 | Nov 16, 2022 |
| Ubuntu | — | Upgrade libfreerdp-client2-2Upgrade libfreerdp-server2-2 | Nov 23, 2022 | Nov 16, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub