CVE-2023-39354

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the nsc_rle_decompress_data function. The Out-Of-Bounds Read occurs because it processes context->Planes without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

• freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350)
• freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351)
• freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352)
• freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (CVE-2023-39356)
• freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface (CVE-2023-40186)
• freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567)
• freerdp: Out-of-bounds write in the progressive_decompress function due to incorrect calculations (CVE-2023-40569)
• freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589)
• freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353)
• freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354)
• freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181)
• freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

• CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation; validate the MIC offset against the AUTHENTICATE_MESSAGE length
• CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data; check that the stream holds the declared plane lengths
• CVE-2026-109244: winpr-makecert: create key and certificate files with owner-only permissions and use a random export password
• CVE-2026-109257: NSCodec encoder: free plane buffers in one place to avoid a double free
• CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when unpacking LocateCardsByATR and reader states
• CVE-2026-111377: server: abort static channel reassembly when fragments exceed the declared total size

• CVE-2026-111880: fix heap out-of-bounds write in NTLM MIC computation; validate the MIC offset against the AUTHENTICATE_MESSAGE length
• CVE-2023-39354: fix out-of-bounds read in nsc_rle_decompress_data; check that the stream holds the declared plane lengths
• CVE-2026-109244: winpr-makecert: create key and certificate files with owner-only permissions and use a random export password
• CVE-2026-109257: NSCodec encoder: free plane buffers in one place to avoid a double free
• CVE-2026-109677: smartcard: validate cbAtr against the rgbAtr size when unpacking LocateCardsByATR and reader states
• CVE-2026-111377: server: abort static channel reassembly when fragments exceed the declared total size

This issue affects Clients only: Integer underflow leading to DOS (e.g. abort due to WINPR_ASSERT with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. (CVE-2023-39350)

Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the rfx_process_message_tileset function, the program allocates tiles using rfx_allocate_tiles for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. (CVE-2023-39351)

Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the libfreerdp/codec/rfx.c file there is no offset validation in tile->quantIdxY, tile->quantIdxCb, and tile->quantIdxCr. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. (CVE-2023-39353)

Affected versions are subject to an Out-Of-Bounds Read in the nsc_rle_decompress_data function. The Out-Of-Bounds Read occurs because it processes context->Planes without checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. (CVE-2023-39354)

Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the zgfx_decompress_segment function. In the context of CopyMemory, it's possible to read data beyond the transmitted packet range and likely cause a crash. (CVE-2023-40181)

Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the gdi_CreateSurface function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. (CVE-2023-40186)

Affected versions are subject to an Out-Of-Bounds Read in the general_LumaToYUV444 function. This Out-Of-Bounds Read occurs because processing is done on the in variable without checking if it contains data of sufficient length. Insufficient data for the in variable may cause errors or crashes. (CVE-2023-40188)

Affected versions are subject to an Out-Of-Bounds Write in the clear_decompress_bands_data function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. (CVE-2023-40567)

Affected versions are subject to an Out-Of-Bounds Write in the progressive_decompress function. This issue is likely down to incorrect calculations of the nXSrc and nYSrc variables. (CVE-2023-40569)

In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. (CVE-2023-40589)

These are all security issues fixed in the freerdp-2.11.2-3.1 package on the GA media of openSUSE Tumbleweed.

This update for freerdp fixes the following issues:

• CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).
• CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).
• CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).
• CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).
• CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).
• CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).
• CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).
• CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).
• CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).
• CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).
• CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).
• CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).
• CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).
• CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).
• CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).

This update for freerdp fixes the following issues:

• CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).
• CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).
• CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).
• CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).
• CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).
• CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).
• CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).
• CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).
• CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).
• CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).
• CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).
• CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).
• CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).
• CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).
• CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).

It was discovered that FreeRDP did not properly manage certain inputs. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2023-39350, CVE-2023-39351, CVE-2023-39353, CVE-2023-39354, CVE-2023-40181, CVE-2023-40188, CVE-2023-40589)

It was discovered that FreeRDP did not properly manage certain inputs. A malicious server could use this issue to cause FreeRDP clients to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2023-40186, CVE-2023-40567, CVE-2023-40569)