CVE-2023-39352CWE-787

Invalid offset validation leading to Out Of Bound Write in FreeRDP

Medium · published August 31, 2023

CVSS v3.1
5.3
EPSS
2%
Percentile
74.6
In the wild
Unconfirmed
What it is

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.01535 · 74.6th percentile
Weakness
CWE-787 · Out-of-bounds Write
Published
2023-08-31T20:46Z
EPSS history
Timeline
  • 31 AUG 20:46Z
    Invalid offset validation leading to Out Of Bound Write in FreeRDP
    cvelistv5