Every CVE Search/ Get API key

CVE-2023-40576

Out-Of-Bounds Read in FreeRDP

5.3 Medium

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

1.24%Up 1.2 points since Sep 1, 2023
90%50%10%1%

What each source reports

CVE List Score used 5.3

Out-Of-Bounds Read in FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Record
CVE-2023-40576
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
EUVDEUVD-2023-45144 5.3

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Record
EUVD-2023-45144
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-03
NVD 5.3

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Record
CVE-2023-40576
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-125
Updated
2026-11-02
OSV 5.3

Out-Of-Bounds Read in FreeRDP

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Record
CVE-2023-40576
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-125
Updated
2026-11-02
OSVUBUNTU-CVE-2023-40576 7.5

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the RleDecompress function. This Out-Of-Bounds Read occurs because FreeRDP processes the pbSrcBuffer variable without checking if it contains data of sufficient length. Insufficient data in the pbSrcBuffer variable may cause errors or crashes. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Record
UBUNTU-CVE-2023-40576
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2024:13815-1 No score

freerdp-3.4.0-1.1 on GA media

These are all security issues fixed in the freerdp-3.4.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13815-1
Updated
2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:13816-1 No score

freerdp2-devel-2.11.5-1.1 on GA media

These are all security issues fixed in the freerdp2-devel-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:13816-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:20339-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

Update to version 3.22.0 (jsc#PED-15526):

  • Major bugfix release:

    • Complete overhaul of SDL client
    • Introduction of new WINPR_ATTR_NODISCARD macro wrapping compiler or C language version specific [[nodiscard]] attributes
    • Addition of WINPR_ATTR_NODISCARD to (some) public API functions so usage errors are producing warnings now
    • Add some more stringify functions for logging
    • We've received CVE reports, check https://github.com/FreeRDP/FreeRDP/security/advisories for more details! @Keryer reported an issue affecting client and proxy:
      • CVE-2026-23948 @ehdgks0627 did some more fuzzying and found quite a number of client side bugs.
      • CVE-2026-24682
      • CVE-2026-24683
      • CVE-2026-24676
      • CVE-2026-24677
      • CVE-2026-24678
      • CVE-2026-24684
      • CVE-2026-24679
      • CVE-2026-24681
      • CVE-2026-24675
      • CVE-2026-24491
      • CVE-2026-24680

  • Changes from version 3.21.0

    • [core,info] fix missing NULL check (#12157)
    • [gateway,tsg] fix TSG_PACKET_RESPONSE parsing (#12161)
    • Allow querying auth identity with kerberos when running as a server (#12162)
    • Sspi krb heimdal (#12163)
    • Tsg fix idleTimeout parsing (#12167)
    • [channels,smartcard] revert 649f7de (#12166)
    • [crypto] deprecate er and der modules (#12170)
    • [channels,rdpei] lock full update, not only parts (#12175)
    • [winpr,platform] add WINPR_ATTR_NODISCARD macro (#12178)
    • Wlog cleanup (#12179)
    • new stringify functions & touch API defines (#12180)
    • Add support for querying SECPKG_ATTR_PACKAGE_INFO to NTLM and Kerberos (#12171)
    • [channels,video] measure times in ns (#12184)
    • [utils] Nodiscard (#12187)
    • Error handling fixes (#12186)
    • [channels,drdynvc] check pointer before reset (#12189)
    • Winpr api def (#12190)
    • [winpr,platform] drop C23 [[nodiscard]] (#12192)
    • [gdi] add additional checks for a valid rdpGdi (#12194)
    • Sdl3 high dpiv2 (#12173)
    • peer: Disconnect if Logon() returned FALSE (#12196)
    • [channels,rdpecam] fix PROPERTY_DESCRIPTION parsing (#12197)
    • [channel,rdpsnd] only clean up thread before free (#12199)
    • [channels,rdpei] add RDPINPUT_CONTACT_FLAG_UP (#12195)

  • Update to version 3.21.0:

    • Bugfix release with a few new API functions addressing shortcomings with regard to input data validation. Thanks to @ehdgks0627 we have fixed the following additional (medium) client side vulnerabilities:

      • CVE-2026-23530
      • CVE-2026-23531
      • CVE-2026-23532
      • CVE-2026-23533
      • CVE-2026-23534
      • CVE-2026-23732
      • CVE-2026-23883
      • CVE-2026-23884

  • Changes from version 3.20.2

    • [client,sdl] fix monitor resolution (#12142)
    • [codec,progressive] fix progressive_rfx_upgrade_block (#12143)
    • Krb cache fix (#12145)
    • Rdpdr improved checks (#12141)
    • Codec advanced length checks (#12146)
    • Glyph fix length checks (#12151)
    • Wlog printf format string checks (#12150)
    • [warnings,format] fix format string warnings (#12152)
    • Double free fixes (#12153)
    • [clang-tidy] clean up code warnings (#12154)

  • Update to version 3.20.2:

    • Patch release fixing a regression with gateway connections introduced with 3.20.1

      What's Changed

      • Warnings and missing enumeration types (#12137)

  • Changes from version 3.20.1:

    • New years cleanup release. Fixes some issues reported and does a cleaning sweep to bring down warnings. Thanks to @ehdgks0627 doing some code review/testing we've uncovered the following (medium) vulnerabilities:

      • CVE-2026-22851
      • CVE-2026-22852
      • CVE-2026-22853
      • CVE-2026-22854
      • CVE-2026-22855
      • CVE-2026-22856
      • CVE-2026-22857
      • CVE-2026-22858
      • CVE-2026-22859

    • These affect FreeRDP based clients only, with the exception of CVE-2026-22858 also affecting FreeRDP proxy. FreeRDP based servers are not affected.

  • Update to version 3.20.0:

    *…

Record
openSUSE-SU-2026:20339-1
Updated
2026-11-02
OSVSUSE-SU-2023:4611-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).
  • CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).
  • CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).
  • CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).
  • CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).
  • CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).
  • CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).
  • CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).
  • CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).
  • CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).
  • CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).
  • CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).
  • CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).
  • CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).
  • CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).
Record
SUSE-SU-2023:4611-1
Updated
2026-11-02
OSVSUSE-SU-2023:4893-1 No score

Security update for freerdp

This update for freerdp fixes the following issues:

  • CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).
  • CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).
  • CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).
  • CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).
  • CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).
  • CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).
  • CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).
  • CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).
  • CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).
  • CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).
  • CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).
  • CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).
  • CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).
  • CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).
  • CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).
Record
SUSE-SU-2023:4893-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
freerdp
SUSE:Linux Enterprise Software Development Kit 12 SP5
From an advisory covering 15 CVEs
 before 2.1.2-12.38.1
2.1.2-12.38.1
freerdp
SUSE:Linux Enterprise Workstation Extension 12 SP5
From an advisory covering 15 CVEs
 before 2.1.2-12.38.1
2.1.2-12.38.1
freerdp
SUSE:Linux Enterprise Module for Package Hub 15 SP4
From an advisory covering 15 CVEs
 before 2.4.0-150400.3.23.1
2.4.0-150400.3.23.1
freerdp
SUSE:Linux Enterprise Module for Package Hub 15 SP5
From an advisory covering 15 CVEs
 before 2.4.0-150400.3.23.1
2.4.0-150400.3.23.1
freerdp
SUSE:Linux Enterprise Workstation Extension 15 SP4
From an advisory covering 15 CVEs
 before 2.4.0-150400.3.23.1
2.4.0-150400.3.23.1
freerdp
SUSE:Linux Enterprise Workstation Extension 15 SP5
From an advisory covering 15 CVEs
 before 2.4.0-150400.3.23.1
2.4.0-150400.3.23.1
freerdp
openSUSE:Leap 15.4
From an advisory covering 15 CVEs
 before 2.4.0-150400.3.23.1
2.4.0-150400.3.23.1
freerdp
openSUSE:Leap 15.5
From an advisory covering 15 CVEs
 before 2.4.0-150400.3.23.1
2.4.0-150400.3.23.1
freerdp
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 3.4.0-1.1
3.4.0-1.1
freerdp2
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 2.11.5-1.1
2.11.5-1.1
freerdp
openSUSE:Leap 16.0
From an advisory covering 44 CVEs
 before 3.22.0-160000.1.1
3.22.0-160000.1.1

History

History
RecordedChangedSources
affected, facts
affected
aliases, publishedEUVD
first indexedCVE List, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-40576 is a medium vulnerability (CVSS 5.3) in Freerdp, published August 31, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.24%, the 69th percentile. No source names a fixed version.

References

Show 105 moreShow less
This page doesn't list everything

Left out here: the rest of 1 source description. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open