CVE-2023-40188
Out-Of-Bounds Read in FreeRDP
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Read in the `general_LumaToYUV444` function. This Out-Of-Bounds Read occurs because processing is done on the `in` variable without checking if it contains data of sufficient length. Insufficient data for the `in` variable may cause errors or crashes. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.
This update for freerdp fixes the following issues. Fixed incorrect offset calculation leading to DoS. Fixed Null Pointer Dereference leading DoS in RemoteFX. Fixed Invalid offset validation leading to Out Of Bound Write. Fixed Missing offset validation leading to Out Of Bound Read. Fixed Out-Of-Bounds Read in nsc_rle_decompress_data. Fixed Missing offset validation leading to Out-of-Bounds Read in gdi_multi_opaque_rect. Fixed Integer-Underflow leading to Out-Of-Bound Read in zgfx_decompress_segment. Fixed IntegerOverflow leading to Out-Of-Bound Write Vulnerability in gdi_CreateSurface. Fixed Out-Of-Bounds Read in general_LumaToYUV444. Fixed Out-Of-Bounds Write in clear_decompress_bands_data. Fixed Out-Of-Bounds Write in progressive_decompress. Fixed Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX. Fixed Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX. Fixed Out-Of-Bounds Read in RleDecompress. Fixed Global-Buffer-Overflow in ncrush_decompress.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2023-08-09 CVE Reserved
- 2023-08-31 CVE Published
- 2025-02-13 CVE Updated
- 2025-02-13 First Exploit
- 2025-07-15 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (9)
| URL | Date | SRC |
|---|---|---|
| https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9w28-wwj5-p4xq | 2025-02-13 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2023-40188 | 2024-04-30 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2236730 | 2024-04-30 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Freerdp Search vendor "Freerdp" | Freerdp Search vendor "Freerdp" for product "Freerdp" | < 2.11.0 Search vendor "Freerdp" for product "Freerdp" and version " < 2.11.0" | - |
Affected
| ||||||
| Freerdp Search vendor "Freerdp" | Freerdp Search vendor "Freerdp" for product "Freerdp" | 3.0.0 Search vendor "Freerdp" for product "Freerdp" and version "3.0.0" | beta1 |
Affected
| ||||||
| Freerdp Search vendor "Freerdp" | Freerdp Search vendor "Freerdp" for product "Freerdp" | 3.0.0 Search vendor "Freerdp" for product "Freerdp" and version "3.0.0" | beta2 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 37 Search vendor "Fedoraproject" for product "Fedora" and version "37" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 38 Search vendor "Fedoraproject" for product "Fedora" and version "38" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 39 Search vendor "Fedoraproject" for product "Fedora" and version "39" | - |
Affected
| ||||||