CVEvulnerability

CVE-2022-41877

4.6 MEDIUM Published 2022-11-16 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2022-11-16
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
CVSS 3.1 ([email protected])
4.6 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Weaknesses
CWE-119, CWE-1284

Description

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the drive redirection channel - command line options `/drive`, `+drives` or `+home-drive`.

Affected configurations

• freerdp freerdp (< 2.9.0) • fedoraproject fedora 36 • fedoraproject fedora 37

Related

Weakness · CWE (2)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness
  • CWE-1284 Improper Validation of Specified Quantity in Input weakness

References