{"id":"CVE-2023-40574","aliases":["EUVD-2023-45142","GHSA-422p-gj6x-93cw","SUSE-SU-2023:4611-1","SUSE-SU-2023:4893-1","UBUNTU-CVE-2023-40574","openSUSE-SU-2024:13815-1","openSUSE-SU-2024:13816-1","openSUSE-SU-2026:20339-1"],"status":"published","title":"Out-Of-Bounds Write in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01206,"percentile":0.68533,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2023-08-31T21:39:17Z","modified":"2026-10-28T02:31:11Z","affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.38.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.38.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.23.1"}]}],"bundled":15},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.4.0-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5-1.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-160000.1.1"}]}],"bundled":44}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-422p-gj6x-93cw","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/blob/5be5553e0da72178a4b94cc1ffbdace9ceb153e5/libfreerdp/primitives/prim_YUV.c#L414-L445","tags":["x_refsource_MISC","x_transferred","Issue Tracking","web","report"]},{"url":"https://security.gentoo.org/glsa/202401-16","tags":["x_transferred","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40574.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40574","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234611-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214856","tags":["report"]},{"url":"https://bugzilla.suse.com/1214857","tags":["report"]},{"url":"https://bugzilla.suse.com/1214858","tags":["report"]},{"url":"https://bugzilla.suse.com/1214859","tags":["report"]},{"url":"https://bugzilla.suse.com/1214860","tags":["report"]},{"url":"https://bugzilla.suse.com/1214862","tags":["report"]},{"url":"https://bugzilla.suse.com/1214863","tags":["report"]},{"url":"https://bugzilla.suse.com/1214864","tags":["report"]},{"url":"https://bugzilla.suse.com/1214866","tags":["report"]},{"url":"https://bugzilla.suse.com/1214867","tags":["report"]},{"url":"https://bugzilla.suse.com/1214868","tags":["report"]},{"url":"https://bugzilla.suse.com/1214869","tags":["report"]},{"url":"https://bugzilla.suse.com/1214870","tags":["report"]},{"url":"https://bugzilla.suse.com/1214871","tags":["report"]},{"url":"https://bugzilla.suse.com/1214872","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39350","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39351","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39352","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39353","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-39356","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40188","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40567","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40589","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20234893-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-40574","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40574","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0250","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0791","tags":["web"]},{"url":"https://bugzilla.suse.com/1219049","tags":["report"]},{"url":"https://bugzilla.suse.com/1223293","tags":["report"]},{"url":"https://bugzilla.suse.com/1223294","tags":["report"]},{"url":"https://bugzilla.suse.com/1223295","tags":["report"]},{"url":"https://bugzilla.suse.com/1223296","tags":["report"]},{"url":"https://bugzilla.suse.com/1223297","tags":["report"]},{"url":"https://bugzilla.suse.com/1223298","tags":["report"]},{"url":"https://bugzilla.suse.com/1223346","tags":["report"]},{"url":"https://bugzilla.suse.com/1223347","tags":["report"]},{"url":"https://bugzilla.suse.com/1223348","tags":["report"]},{"url":"https://bugzilla.suse.com/1223353","tags":["report"]},{"url":"https://bugzilla.suse.com/1243109","tags":["report"]},{"url":"https://bugzilla.suse.com/1256717","tags":["report"]},{"url":"https://bugzilla.suse.com/1256718","tags":["report"]},{"url":"https://bugzilla.suse.com/1256719","tags":["report"]},{"url":"https://bugzilla.suse.com/1256720","tags":["report"]},{"url":"https://bugzilla.suse.com/1256721","tags":["report"]},{"url":"https://bugzilla.suse.com/1256722","tags":["report"]},{"url":"https://bugzilla.suse.com/1256723","tags":["report"]},{"url":"https://bugzilla.suse.com/1256724","tags":["report"]},{"url":"https://bugzilla.suse.com/1256725","tags":["report"]},{"url":"https://bugzilla.suse.com/1256940","tags":["report"]},{"url":"https://bugzilla.suse.com/1256941","tags":["report"]},{"url":"https://bugzilla.suse.com/1256942","tags":["report"]},{"url":"https://bugzilla.suse.com/1256943","tags":["report"]},{"url":"https://bugzilla.suse.com/1256944","tags":["report"]},{"url":"https://bugzilla.suse.com/1256945","tags":["report"]},{"url":"https://bugzilla.suse.com/1256946","tags":["report"]},{"url":"https://bugzilla.suse.com/1256947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32460","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24684","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-40574","title":"Out-Of-Bounds Write in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T21:39:17.151Z","modified":"2025-02-13T17:08:32.461Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:21.612665Z"}],"euvd":[{"id":"EUVD-2023-45142","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T21:39:17Z","modified":"2025-02-13T17:08:32Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:03:49.098775Z"}],"nvd":[{"id":"CVE-2023-40574","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T22:15:08.793Z","modified":"2026-06-17T06:18:31.987Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:08:27.181588Z"}],"osv":[{"id":"CVE-2023-40574","title":"Out-Of-Bounds Write in FreeRDP","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"published","published":"2023-08-31T21:39:17.151Z","modified":"2026-10-28T02:31:11.020153562Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:33.244128Z"},{"id":"UBUNTU-CVE-2023-40574","description":"FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `writePixelBGRX` function. This issue is likely down to incorrect calculations of the `nHeight` and `srcStep` variables. This issue has been addressed in version 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.","status":"withdrawn","published":"2023-08-31T22:15:00Z","modified":"2025-07-16T08:16:58.662011Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:22.741943Z"},{"id":"openSUSE-SU-2024:13815-1","title":"freerdp-3.4.0-1.1 on GA media","description":"These are all security issues fixed in the freerdp-3.4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:28:54.57761Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13816-1","title":"freerdp2-devel-2.11.5-1.1 on GA media","description":"These are all security issues fixed in the freerdp2-devel-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:04.690656Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2026:20339-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\nUpdate to version 3.22.0 (jsc#PED-15526):\n\n  + Major bugfix release:\n\n    * Complete overhaul of SDL client\n    * Introduction of new WINPR_ATTR_NODISCARD macro wrapping compiler or C language version specific [[nodiscard]] attributes\n    * Addition of WINPR_ATTR_NODISCARD to (some) public API functions so usage errors are producing warnings now\n    * Add some more stringify functions for logging\n    * We've received CVE reports, check\n      https://github.com/FreeRDP/FreeRDP/security/advisories for more details!\n      @Keryer reported an issue affecting client and proxy:\n      * CVE-2026-23948\n      @ehdgks0627 did some more fuzzying and found quite a number of client side bugs.\n      * CVE-2026-24682\n      * CVE-2026-24683\n      * CVE-2026-24676\n      * CVE-2026-24677\n      * CVE-2026-24678\n      * CVE-2026-24684\n      * CVE-2026-24679\n      * CVE-2026-24681\n      * CVE-2026-24675\n      * CVE-2026-24491\n      * CVE-2026-24680\n\n- Changes from version 3.21.0\n\n  * [core,info] fix missing NULL check (#12157)\n  * [gateway,tsg] fix TSG_PACKET_RESPONSE parsing (#12161)\n  * Allow querying auth identity with kerberos when running as a server (#12162)\n  * Sspi krb heimdal (#12163)\n  * Tsg fix idleTimeout parsing (#12167)\n  * [channels,smartcard] revert 649f7de (#12166)\n  * [crypto] deprecate er and der modules (#12170)\n  * [channels,rdpei] lock full update, not only parts (#12175)\n  * [winpr,platform] add WINPR_ATTR_NODISCARD macro (#12178)\n  * Wlog cleanup (#12179)\n  * new stringify functions \u0026 touch API defines (#12180)\n  * Add support for querying SECPKG_ATTR_PACKAGE_INFO to NTLM and Kerberos (#12171)\n  * [channels,video] measure times in ns (#12184)\n  * [utils] Nodiscard (#12187)\n  * Error handling fixes (#12186)\n  * [channels,drdynvc] check pointer before reset (#12189)\n  * Winpr api def (#12190)\n  * [winpr,platform] drop C23 [[nodiscard]] (#12192)\n  * [gdi] add additional checks for a valid rdpGdi (#12194)\n  * Sdl3 high dpiv2 (#12173)\n  * peer: Disconnect if Logon() returned FALSE (#12196)\n  * [channels,rdpecam] fix PROPERTY_DESCRIPTION parsing (#12197)\n  * [channel,rdpsnd] only clean up thread before free (#12199)\n  * [channels,rdpei] add RDPINPUT_CONTACT_FLAG_UP (#12195)\n\n- Update to version 3.21.0:\n\n  + Bugfix release with a few new API functions addressing shortcomings with\n    regard to input data validation.\n    Thanks to @ehdgks0627 we have fixed the following additional (medium)\n    client side vulnerabilities:\n\n    * CVE-2026-23530\n    * CVE-2026-23531\n    * CVE-2026-23532\n    * CVE-2026-23533\n    * CVE-2026-23534\n    * CVE-2026-23732\n    * CVE-2026-23883\n    * CVE-2026-23884\n\n- Changes from version 3.20.2\n\n  * [client,sdl] fix monitor resolution (#12142)\n  * [codec,progressive] fix progressive_rfx_upgrade_block (#12143)\n  * Krb cache fix (#12145)\n  * Rdpdr improved checks (#12141)\n  * Codec advanced length checks (#12146)\n  * Glyph fix length checks (#12151)\n  * Wlog printf format string checks (#12150)\n  * [warnings,format] fix format string warnings (#12152)\n  * Double free fixes (#12153)\n  * [clang-tidy] clean up code warnings (#12154)\n\n- Update to version 3.20.2:\n\n  + Patch release fixing a regression with gateway connections\n    introduced with 3.20.1\n    ## What's Changed\n    * Warnings and missing enumeration types (#12137)\n\n- Changes from version 3.20.1:\n\n  + New years cleanup release. Fixes some issues reported and does\n    a cleaning sweep to bring down warnings.\n    Thanks to @ehdgks0627 doing some code review/testing we've\n    uncovered the following (medium) vulnerabilities:\n\n    * CVE-2026-22851\n    * CVE-2026-22852\n    * CVE-2026-22853\n    * CVE-2026-22854\n    * CVE-2026-22855\n    * CVE-2026-22856\n    * CVE-2026-22857\n    * CVE-2026-22858\n    * CVE-2026-22859\n\n  + These affect FreeRDP based clients only, with the exception of\n    CVE-2026-22858 also affecting FreeRDP proxy. FreeRDP based\n    servers are not affected.\n\n- Update to version 3.20.0:\n\n  * Mingw fixes (#12070)\n  * [crypto,certificate_data] add some hostname sanitation\n  * [client,common]: Fix loading of rdpsnd channel\n  * [client,sdl] set touch and pen hints\n\n- Changes from version 3.19.1:\n\n  * [core,transport] improve SSL error logging\n  * [utils,helpers] fix freerdp_settings_get_legacy_config_path\n  * From stdin and sdl-creds improve\n  * [crypto,certificate] sanitize hostnames\n  * [channels,drdynvc] propagate error in dynamic channel\n  * [CMake] make Mbed-TLS and LibreSSL experimental\n  * Json fix\n  * rdpecam: send sample only if it's available\n  * [channels,rdpecam] allow MJPEG frame skip and direct passthrough\n  * [winpr,utils] explicit NULL checks in jansson WINPR_JSON_ParseWithLength\n\n- Changes from version 3.19.0:\n\n  * [client,common] fix retry counter\n  * [cmake] fix aarch64 neon detection\n  * Fix response body existence check when using RDP Gateway\n  * fix line clipping issue\n  * Clip coord fix\n  * [core,input] Add debug log to keyboard state sync\n  * Update command line usage for gateway option\n  * [codec,ffmpeg] 8.0 dropped AV_PROFILE_AAC_MAIN\n  * [channels,audin] fix pulse memory leak\n  * [channels,drive] Small performance improvements in drive channel\n  * [winpr,utils] fix command line error logging\n  * [common,test] Adjust AVC and H264 expectations\n  * drdynvc: implement compressed packet\n  * [channels,rdpecam] improve log messages\n  * Fix remote credential guard channel loading\n  * Fix inverted ifdef\n  * [core,nego] disable all enabled modes except the one requested\n  * rdpear: handle basic NTLM commands and fix server-side\n  * [smartcardlogon] Fix off-by-one error in `smartcard_hw_enumerateCerts`\n  * rdpecam: fix camera sample grabbing\n\n- Update to version 3.18.0:\n\n  + Fix a regression reading passwords from stdin\n  + Fix a timer regression (µs instead of ms)\n  + Improved multitouch support\n  + Fix a bug with PLANAR codec (used with /bpp:32 or sometimes with /gfx)\n  + Better error handling for ARM transport (Entra)\n  + Fix audio encoder lag (microphone/AAC) with FFMPEG\n  + Support for janssen JSON library\n\n- Update to version 3.17.2:\n\n  + Minor improvements and bugfix release.\n  + Most notably resource usage (file handles) has been greatly reduced and\n    static build pkg-config have been fixed.\n    For users of xfreerdp RAILS/RemoteApp mode the switch to DesktopSession\n    mode has been fixed (working UAC screen)\n\n- Changes from version 3.17.1\n\n  + Minor improvements and bugfix release.\n    * most notably a memory leak was addressed\n    * fixed header files missing C++ guards\n    * xfreerdp as well as the SDL clients now support a system wide configuration file\n    * Heimdal kerberos support was improved\n    * builds with [MS-RDPEAR] now properly abort at configure if Heimdal is used\n      (this configuration was never supported, so ensure nobody compiles it that way)\n\n- Enable openh264 support, we can build against the noopenh264 stub\n\n- Update to 3.17.0:\n\n  * [client,sdl2] fix build with webview (#11685)\n  * [core,nla] use wcslen for password length (#11687)\n  * Clear channel error prior to call channel init event proc (#11688)\n  * Warn args (#11689)\n  * [client,common] fix -mouse-motion (#11690)\n  * [core,proxy] fix IPv4 and IPv6 length (#11692)\n  * Regression fix2 (#11696)\n  * Log fixes (#11693)\n  * [common,settings] fix int casts (#11699)\n  * [core,connection] fix log level of several messages (#11697)\n  * [client,sdl] print current video driver (#11701)\n  * [crypto,tls] print big warning for /cert:ignore (#11704)\n  * [client,desktop] fix StartupWMClass setting (#11708)\n  * [cmake] unify version creation (#11711)\n  * [common,settings] force reallocation on caps copy (#11715)\n  * [manpages] Add example of keyboard remapping (#11718)\n  * Some fixes in Negotiate and NLA (#11722)\n  * [client,x11] fix clipboard issues (#11724)\n  * kerberos: do various tries for TGT retrieval in u2u (#11723)\n  * Cmdline escape strings (#11735)\n  * [winpr,utils] do not log command line arguments (#11736)\n  * [api,doc] Add stylesheed for doxygen (#11738)\n  * [core,proxy] fix BIO read methods (#11739)\n  * [client,common] fix sso_mib_get_access_token return value in error case (#11741)\n  * [crypto,tls] do not use context-\u003esettings-\u003einstance (#11749)\n  * winpr: re-introduce the credentials module (#11734)\n  * [winpr,timezone] ensure thread-safe initialization (#11754)\n  * core/redirection: Ensure stream has enough space for the certificate (#11762)\n  * [client,common] do not log success (#11766)\n  * Clean up bugs exposed on systems with high core counts (#11761)\n  * [cmake] add installWithRPATH (#11747)\n  * [clang-tidy] fix various warnings (#11769)\n  * Wlog improve type checks (#11774)\n  * [client,common] fix tenantid command line parsing (#11779)\n  * Proxy module static and shared linking support (#11768)\n  * LoadLibrary Null fix (#11786)\n  * [client,common] add freerdp_client_populate_settings_from_rdp_file_un… (#11780)\n  * Fullchain support (#11787)\n  * [client,x11] ignore floatbar events (#11771)\n  * [winpr,credentials] prefer utf-8 over utf-16-LE #11790\n  * [proxy,modules] ignore bitmap-filter skip remaining #11789\n\n- Update to 3.16.0:\n  * Lots of improvements for the SDL3 client\n  * Various X11 client improvements\n  * Add a timer implementation\n  * Various AAD/Azure/Entra improvements\n  * YUV420 primitives fixes\n- Update to 3.15.0:\n  * [client,sdl] fix crash on suppress output\n  * [channels,remdesk] fix possible memory leak\n  * [client,x11] map exit code success\n  * Hidef rail checks and deprecation fixe\n  * Standard rdp security network issues\n  * [core,rdp] fix check for SEC_FLAGSHI_VALID\n  * [core,caps] fix rdp_apply_order_capability_set\n  * [core,proxy] align no_proxy to curl\n  * [core,gateway] fix string reading for TSG\n  * [client,sdl] refactor display update\n\n- Update to version 3.14.0:\n\n  + Bugfix and cleanup release. Due to some new API functions the\n    minor version has been increased.\n\n- Changes from version 3.13.0:\n\n  + Friends of old hardware rejoice, serial port redirection got an\n    update (not kidding you)\n  + Android builds have been updated to be usable again\n  + Mingw builds now periodically do a shared and static build\n  + Fixed some bugs and regressions along the way and improved test\n    coverage as well\n\n- Changes from version 3.12.0:\n\n  + Multimonitor backward compatibility fixes\n  + Smartcard compatibility\n  + Improve the [MS-RDPECAM] support\n  + Improve smartcard redirection support\n  + Refactor SSE optimizations: Split headers, unify load/store,\n    require SSE3 for all optimized functions\n  + Refactors the CMake build to better support configuration based\n    builders\n  + Fix a few regressions from last release (USB redirection and\n    graphical glitches)\n\n- Changes from version 3.11.0:\n\n  + A new release with bugfixes and code cleanups as well as a few\n    nifty little features\n\n- CVE-2024-22211: In affected versions an integer overflow in\n    `freerdp_bitmap_planar_context_reset` leads to heap-buffer\n    overflow. (bsc#1219049)\n\n- CVE-2024-32658: Fixedout-of-bounds read in Interleaved RLE Bitmap Codec in FreeRDP based clients (bsc#1223353)\n\n- Multiple CVE fixes\n  + CVE-2024-32659: Fixed out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`(bsc#1223346)\n  + CVE-2024-32660: Fixed client crash via invalid huge allocation size (bsc#1223347)\n  + CVE-2024-32661: Fixed client NULL pointer dereference (bsc#1223348)\n\n- Multiple CVE fixes:\n    * bsc#1223293, CVE-2024-32039\n    * bsc#1223294, CVE-2024-32040\n    * bsc#1223295, CVE-2024-32041\n    * bsc#1223296, CVE-2024-32458\n    * bsc#1223297, CVE-2024-32459\n    * bsc#1223298, CVE-2024-32460\n\n  * Fix CVE-2023-40574 - bsc#1214869: Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX\n  * Fix CVE-2023-40575 - bsc#1214870: Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX\n  * Fix CVE-2023-40576 - bsc#1214871: Out-Of-Bounds Read in RleDecompress\n","status":"published","published":"2026-03-10T12:34:56Z","modified":"2026-03-23T04:54:51.488216Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2023:4611-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).\n- CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).\n- CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).\n- CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).\n- CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).\n- CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).\n- CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).\n- CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).\n- CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).\n- CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).\n- CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).\n- CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).\n- CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).\n- CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).\n- CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).\n","status":"published","published":"2023-11-29T13:50:28Z","modified":"2026-02-04T02:28:28.110014Z","updated_at":"2026-11-02T15:53:53.865042Z"},{"id":"SUSE-SU-2023:4893-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2023-39350: Fixed incorrect offset calculation leading to DoS (bsc#1214856).\n- CVE-2023-39351: Fixed Null Pointer Dereference leading DoS in RemoteFX (bsc#1214857).\n- CVE-2023-39352: Fixed Invalid offset validation leading to Out Of Bound Write (bsc#1214858).\n- CVE-2023-39353: Fixed Missing offset validation leading to Out Of Bound Read (bsc#1214859).\n- CVE-2023-39354: Fixed Out-Of-Bounds Read in nsc_rle_decompress_data (bsc#1214860).\n- CVE-2023-39356: Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect (bsc#1214862).\n- CVE-2023-40181: Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment (bsc#1214863).\n- CVE-2023-40186: Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface (bsc#1214864).\n- CVE-2023-40188: Fixed Out-Of-Bounds Read in general_LumaToYUV444 (bsc#1214866).\n- CVE-2023-40567: Fixed Out-Of-Bounds Write in clear_decompress_bands_data (bsc#1214867).\n- CVE-2023-40569: Fixed Out-Of-Bounds Write in progressive_decompress (bsc#1214868).\n- CVE-2023-40574: Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214869).\n- CVE-2023-40575: Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX (bsc#1214870).\n- CVE-2023-40576: Fixed Out-Of-Bounds Read in RleDecompress (bsc#1214871).\n- CVE-2023-40589: Fixed Global-Buffer-Overflow in ncrush_decompress (bsc#1214872).\n","status":"published","published":"2023-12-18T15:34:34Z","modified":"2026-02-04T03:30:47.168448Z","updated_at":"2026-11-02T15:53:53.865042Z"}]}}