CVE-2023-39350CWE-191

Incorrect offset calculation leading to denial of service in FreeRDP

Medium · published August 31, 2023

CVSS v3.1
5.9
EPSS
2%
Percentile
76.2
In the wild
Unconfirmed
What it is

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01639 · 76.2th percentile
Weakness
CWE-191 · Integer Underflow (Wrap or Wraparound)
Published
2023-08-31T19:31Z
EPSS history
Timeline
  • 31 AUG 19:31Z
    Incorrect offset calculation leading to denial of service in FreeRDP
    cvelistv5