CVEvulnerability

CVE-2022-39319

4.6 MEDIUM Published 2022-11-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Weaknesses
CWE-125

Description

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

Affected configurations

• freerdp freerdp (< 2.9.0) • fedoraproject fedora 36 • fedoraproject fedora 37

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References