reeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Configuration 1 (hide)
|
Configuration 2 (hide)
|
03 Nov 2025, 21:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
11 Apr 2025, 14:48
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security.gentoo.org/glsa/202401-16 - Third Party Advisory |
13 Feb 2025, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | (en) FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
21 Nov 2024, 08:15
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.3 |
| References | () https://github.com/FreeRDP/FreeRDP/blob/63a2f65618748c12f79ff7450d46c6e194f2db76/libfreerdp/gdi/gfx.c#L1219-L1239 - Issue Tracking | |
| References | () https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj - Exploit, Vendor Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/[email protected]/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/[email protected]/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/ - Mailing List | |
| References | () https://lists.fedoraproject.org/archives/list/[email protected]/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/ - Mailing List | |
| References | () https://security.gentoo.org/glsa/202401-16 - |
Published : 2023-08-31 21:15
Updated : 2025-11-03 21:15
NVD link : CVE-2023-39352
Mitre link : CVE-2023-39352
CVE.ORG link : CVE-2023-39352
JSON object : View
Out-of-bounds Write