{"id":"CVE-2023-40186","aliases":["ALSA-2024:2208","CLSA-2024-1721206783","DEBIAN-CVE-2023-40186","DLA-3606-1","DLA-4053-1","EUVD-2023-44785","GHSA-hcj4-3c3r-5j3v","MGASA-2023-0318","OESA-2023-1656","RHSA-2024:2208","SUSE-SU-2023:4611-1","SUSE-SU-2023:4893-1","UBUNTU-CVE-2023-40186","USN-6401-1","openSUSE-SU-2024:13504-1"],"status":"published","title":"IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01357,"percentile":0.71864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-190","CWE-787"],"published":"2023-08-31T21:13:57Z","modified":"2026-10-29T11:31:43Z","fixes":[{"ecosystem":"Debian:12","package":"freerdp2","fixed_in":["2.11.7+dfsg1-6~deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.18.04.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","fixed_in":["2.2.0+dfsg1-0ubuntu0.20.04.5"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","fixed_in":["2.6.1+dfsg1-3ubuntu2.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"AlmaLinux:9","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els1"}]}],"bundled":12},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els1"}]}],"bundled":12},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els1"}]}],"bundled":12},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els1"}]}],"bundled":12},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els1"}]}],"bundled":12},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7+dfsg1-6~deb12u1"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5"]},{"source":"osv","ecosystem":"Debian:10","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb10u3"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u1","2.0.0~git20190204.1.2693389a+dfsg1-1+deb10u2","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2~bpo10+1","2.1.1+dfsg1-1","2.1.2+dfsg1-1","2.1.2+dfsg1-2","2.2.0+dfsg1-1","2.2.0+dfsg1-1~bpo10+1","2.3.0+dfsg1-1","2.3.0+dfsg1-1~bpo10+1","2.3.0+dfsg1-2"],"bundled":46},{"source":"osv","ecosystem":"Debian:11","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb11u2"}]}],"versions":["2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb11u1"],"bundled":32},{"source":"osv","ecosystem":"Mageia:8","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.0-1.2.mga8"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:9","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-2.1.mga9"}]}],"bundled":10},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1.oe1"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1.oe1"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1.oe2203sp2"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1.oe2203sp1"}]}],"bundled":12},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.1-1.oe2203sp2"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.2-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.38.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.38.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.4+esm1"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.5"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.4"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.18.04.4+esm1"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.0+dfsg1-0ubuntu0.20.04.5"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.4"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3"],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-3.1"}]}],"bundled":14}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hcj4-3c3r-5j3v","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/blob/fee2b10ba1154f952769a53eb608f044782e22f8/libfreerdp/gdi/gfx.c#L1156-L1165","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/","tags":["x_transferred","Mailing List","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://security.gentoo.org/glsa/202401-16","tags":["x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2208","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39350","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39351","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39352","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39353","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39354","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-39356","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40181","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40186","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40188","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40567","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40569","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40589","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236606","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236650","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236656","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236669","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236730","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236750","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236759","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236763","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236766","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236774","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236779","tags":["report"]},{"url":"https://bugzilla.redhat.com/2236784","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2208.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2024-1721206783.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40186.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40186","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-40186","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0318.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32360","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6401-1","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1656","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39350","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39351","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39352","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39353","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39354","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39356","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40181","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40188","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40567","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40589","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236606","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236650","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236656","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236669","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236730","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236750","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236759","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236766","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236784","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-10060","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2208.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39350","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rrrv-3w42-pffh","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39351","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q9x9-cqjc-rgwq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39352","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-whwr-qcf2-2mvj","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39353","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hg53-9j9h-3c8f","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39354","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c3r2-pxxp-f8r6","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-39356","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5v5-qhj5-mh6m","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40181","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxp4-rx7x-h2g8","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40186","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40188","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40567","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-2w9f-8wg4-8jfp","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40569","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hm8c-rcjg-c8qp","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40589","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42x","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234611-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214856","tags":["report"]},{"url":"https://bugzilla.suse.com/1214857","tags":["report"]},{"url":"https://bugzilla.suse.com/1214858","tags":["report"]},{"url":"https://bugzilla.suse.com/1214859","tags":["report"]},{"url":"https://bugzilla.suse.com/1214860","tags":["report"]},{"url":"https://bugzilla.suse.com/1214862","tags":["report"]},{"url":"https://bugzilla.suse.com/1214863","tags":["report"]},{"url":"https://bugzilla.suse.com/1214864","tags":["report"]},{"url":"https://bugzilla.suse.com/1214866","tags":["report"]},{"url":"https://bugzilla.suse.com/1214867","tags":["report"]},{"url":"https://bugzilla.suse.com/1214868","tags":["report"]},{"url":"https://bugzilla.suse.com/1214869","tags":["report"]},{"url":"https://bugzilla.suse.com/1214870","tags":["report"]},{"url":"https://bugzilla.suse.com/1214871","tags":["report"]},{"url":"https://bugzilla.suse.com/1214872","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40589","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234893-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-40186","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39350","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39351","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39353","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-39354","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40188","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40567","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40569","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-40589","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24882","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24883","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-40186","title":"IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T21:13:57.792Z","modified":"2025-11-03T20:35:51.128Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787","CWE-190"],"updated_at":"2026-11-02T14:35:21.971258Z"}],"euvd":[{"id":"EUVD-2023-44785","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T21:13:57Z","modified":"2025-11-03T20:35:51Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T19:49:32.503916Z"}],"nvd":[{"id":"CVE-2023-40186","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T22:15:08.303Z","modified":"2026-06-17T06:16:37.37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T14:08:27.181588Z"}],"osv":[{"id":"CVE-2023-40186","title":"IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T21:13:57.792Z","modified":"2026-10-28T02:31:12.675610635Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-190","CWE-787"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"DEBIAN-CVE-2023-40186","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T22:15:08.303Z","modified":"2026-10-26T18:02:31.936320021Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"OESA-2023-1656","title":"freerdp security update","description":"FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft\u0026apos;s open specifications. This package provides the client applications xfreerdp and wlfreerdp.\r\n\r\nSecurity Fix(es):\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n(CVE-2023-39350)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling.  Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2023-39351)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect-\u0026gt;left` and `rect-\u0026gt;top` are exactly equal to `surface-\u0026gt;width` and  `surface-\u0026gt;height`. eg. `rect-\u0026gt;left` == `surface-\u0026gt;width` \u0026amp;\u0026amp; `rect-\u0026gt;top` == `surface-\u0026gt;height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n(CVE-2023-39352)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a missing offset validation leading to Out Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile-\u0026gt;quantIdxY`, `tile-\u0026gt;quantIdxCb`, and `tile-\u0026gt;quantIdxCr`. As a result crafted input can lead to an out of bounds read access which in turn will cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2023-39353)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs because it processes `context-\u0026gt;Planes` without  checking if it contains data of sufficient length. Should an attacker be able to leverage this vulnerability they may be able to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2023-39354)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offset validation may lead to an Out Of Bound Read in the function `gdi_multi_opaque_rect`. In particular there is no code to validate if the value `multi_opaque_rect-\u0026gt;numRectangles` is less than 45. Looping through `multi_opaque_rect-\u0026gt;`numRectangles without proper boundary checks can lead to Out-of-Bounds Read errors which will likely lead to a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n(CVE-2023-39356)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Integer-Underflow leading to Out-Of-Bound Read in the `zgfx_decompress_segment` function. In the context of `CopyMemory`, it\u0026apos;s possible to read data beyond the transmitted packet range and likely cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.(CVE-2023-40181)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.(CVE-2023-40186)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.(CVE-2023-40188)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `clear_decompress_bands_data` function in which there is no offset validation. Abuse of this vulnerability may lead to an out of bounds write. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.(CVE-2023-40567)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.(CVE-2023-40569)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.(CVE-2023-40589)","status":"published","published":"2023-09-15T11:06:06Z","modified":"2026-08-18T01:17:05.816472818Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2024:2208","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2024-09-16T16:00:24Z","modified":"2026-06-26T12:22:38.749423024Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-40186","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T22:15:00Z","modified":"2026-04-22T14:10:58.760573Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"ALSA-2024:2208","title":"Moderate: freerdp security update","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.\n\nSecurity Fix(es):\n\n* freerdp: Incorrect offset calculation leading to DOS (CVE-2023-39350)\n* freerdp: Null Pointer Dereference leading DOS in RemoteFX (CVE-2023-39351)\n* freerdp: invalid offset validation leading to Out Of Bound Write (CVE-2023-39352)\n* freerdp: missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (CVE-2023-39356)\n* freerdp: Integer overflow leading to out-of-bound write vulnerability in gdi_CreateSurface (CVE-2023-40186)\n* freerdp: Out-of-bounds write in clear_decompress_bands_data (CVE-2023-40567)\n* freerdp: Out-of-bounds write in the `progressive_decompress` function due to incorrect calculations (CVE-2023-40569)\n* freerdp: buffer overflow in ncrush_decompress causes crash with crafted input (CVE-2023-40589)\n* freerdp: missing offset validation leading to Out Of Bound Read (CVE-2023-39353)\n* freerdp: Out-Of-Bounds Read in nsc_rle_decompress_data (CVE-2023-39354)\n* freerdp: integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (CVE-2023-40181)\n* freerdp: Out-of-bounds read in general_LumaToYUV444 (CVE-2023-40188)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:43.21165821Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2024-1721206783","title":"freerdp: Fix of 12 CVEs","description":"- CVE-2023-39352: add bound check in gdi_SolidFill\n- CVE-2023-39353: check indices are within range\n- CVE-2023-39356: fix checks for multi opaque rect\n- CVE-2023-40181: fix cBitsRemaining calculation\n- CVE-2023-40186: fix integer multiplications\n- CVE-2023-40188: fix input length validation\n- CVE-2023-40567: fix missing bounds checks\n- CVE-2023-40569: fix missing destination checks\n- CVE-2024-22211: check resolution for overflow\n- CVE-2023-39351: free content of currentMessage on fail\n- CVE-2023-39350: fix possible out of bound read\n- CVE-2023-40589: properly verify all offsets while decoding data","status":"published","published":"2024-07-17T08:59:46Z","modified":"2026-10-21T10:47:53.940713771Z","updated_at":"2026-11-02T15:43:40.88185Z"},{"id":"DLA-3606-1","title":"freerdp2 - security update","status":"published","published":"2023-10-07T00:00:00Z","modified":"2026-03-09T01:19:16.377353Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-4053-1","title":"freerdp2 - security update","status":"published","published":"2025-02-15T00:00:00Z","modified":"2026-03-09T01:19:24.57066Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0318","title":"Updated freerdp packages fix security vulnerabilities","description":"This issue affects Clients only:  Integer underflow leading to DOS (e.g.\nabort due to `WINPR_ASSERT` with default compilation flags). When an\ninsufficient blockLen is provided, and proper length validation is not\nperformed, an Integer Underflow occurs, leading to a Denial of Service\n(DOS) vulnerability. (CVE-2023-39350)\n\n\nAffected versions of FreeRDP are subject to a Null Pointer Dereference\nleading a crash in the RemoteFX (rfx) handling. Inside the\n`rfx_process_message_tileset` function, the program allocates tiles\nusing `rfx_allocate_tiles` for the number of numTiles. If the\ninitialization process of tiles is not completed for various reasons,\ntiles will have a NULL pointer. Which may be accessed in further\nprocessing and would cause a program crash. (CVE-2023-39351)\n\nAffected versions are subject to a missing offset validation leading to\nOut Of Bound Read. In the `libfreerdp/codec/rfx.c` file there is no offset validation in `tile-\u003equantIdxY`, `tile-\u003equantIdxCb`, and\n`tile-\u003equantIdxCr`. As a result crafted input can lead to an out of\nbounds read access which in turn will cause a crash. (CVE-2023-39353)\n\nAffected versions are subject to an Out-Of-Bounds Read in the\n`nsc_rle_decompress_data` function. The Out-Of-Bounds Read occurs\nbecause it processes `context-\u003ePlanes` without checking if it contains\ndata of sufficient length. Should an attacker be able to leverage this\nvulnerability they may be able to cause a crash. (CVE-2023-39354)\n\nAffected versions are subject to an Integer-Underflow leading to\nOut-Of-Bound Read in the `zgfx_decompress_segment` function. In the\ncontext of `CopyMemory`, it's possible to read data beyond the\ntransmitted packet range and likely cause a crash. (CVE-2023-40181)\n\nAffected versions are subject to an IntegerOverflow leading to\nOut-Of-Bound Write Vulnerability in the `gdi_CreateSurface` function.\nThis issue affects FreeRDP based clients only. FreeRDP proxies are not\naffected as image decoding is not done by a proxy. (CVE-2023-40186)\n\nAffected versions are subject to an Out-Of-Bounds Read in the\n`general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because\nprocessing is done on the `in` variable without checking if it contains\ndata of sufficient length. Insufficient data for the `in` variable may\ncause errors or crashes. (CVE-2023-40188)\n\nAffected versions are subject to an Out-Of-Bounds Write in the\n`clear_decompress_bands_data` function in which there is no offset\nvalidation. Abuse of this vulnerability may lead to an out of bounds\nwrite. (CVE-2023-40567)\n\nAffected versions are subject to an Out-Of-Bounds Write in the\n`progressive_decompress` function. This issue is likely down to\nincorrect calculations of the `nXSrc` and `nYSrc` variables.\n(CVE-2023-40569)\n\nIn affected versions there is a Global-Buffer-Overflow in the\nncrush_decompress function. Feeding crafted input into this function can\ntrigger the overflow which has only been shown to cause a crash.\n(CVE-2023-40589)\n","status":"published","published":"2023-11-15T11:35:09Z","modified":"2026-04-16T04:43:02.331074006Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13504-1","title":"freerdp-2.11.2-3.1 on GA media","description":"These are all security issues fixed in the freerdp-2.11.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:03:22.065375Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"SUSE-SU-2023:4611-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).\n- CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).\n- CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).\n- CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).\n- CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).\n- CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).\n- CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).\n- CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).\n- CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).\n- CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).\n- CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).\n- CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).\n- CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).\n- CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).\n- CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).\n","status":"published","published":"2023-11-29T13:50:28Z","modified":"2026-02-04T02:28:28.110014Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4893-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).\n- CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).\n- CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).\n- CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).\n- CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).\n- CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).\n- CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).\n- CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).\n- CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).\n- CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).\n- CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).\n- CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).\n- CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).\n- CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).\n- CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).\n","status":"published","published":"2023-12-18T15:34:34Z","modified":"2026-02-04T03:30:47.168448Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"USN-6401-1","title":"freerdp2 vulnerabilities","description":"It was discovered that FreeRDP did not properly manage certain inputs. A\nmalicious server could use this issue to cause FreeRDP clients to crash,\nresulting in a denial of service, or possibly obtain sensitive \ninformation. (CVE-2023-39350, CVE-2023-39351,  CVE-2023-39353, \nCVE-2023-39354, CVE-2023-40181, CVE-2023-40188, CVE-2023-40589)\n\nIt was discovered that FreeRDP did not properly manage certain inputs. A\nmalicious server could use this issue to cause FreeRDP clients to crash,\nresulting in a denial of service, or possibly execute arbitrary code.\n(CVE-2023-40186, CVE-2023-40567, CVE-2023-40569)\n","status":"published","published":"2023-10-04T11:00:57Z","modified":"2026-04-22T10:39:55.279573Z","updated_at":"2026-11-02T16:58:17.305935Z"}]}}