CVE-2023-39350
MediumCVSS 5.9Exploitation Probability (EPSS)
Elevated risk69th percentile - higher than 69% of all known CVEs
Summary
The vulnerability in FreeRDP affects clients and involves an integer underflow leading to a Denial of Service (DOS). The issue occurs when an insufficient block length is provided, and proper length validation is not performed.
Risk Assessment
Organizations may experience a denial of service, potentially leading to downtime of remote desktop services. As a result, users may be unable to access critical resources.
Recommendation
It is recommended to upgrade to version 2.11.0 or 3.0.0-beta3 to mitigate this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.