CVE-2023-40569
MediumCVSS 6.5Exploitation Probability (EPSS)
Elevated risk62th percentile - higher than 62% of all known CVEs
Summary
FreeRDP, a free implementation of the RDP protocol, has a vulnerability due to an Out-Of-Bounds Write in the `progressive_decompress` function. The issue is caused by incorrect calculations of the `nXSrc` and `nYSrc` variables. It has been addressed in versions 2.11.0 and 3.0.0-beta3.
Risk Assessment
Organizations using affected versions of FreeRDP may be exposed to attacks that could lead to unauthorized access or data corruption.
Recommendation
It is recommended to upgrade to version 2.11.0 or 3.0.0-beta3 to mitigate this vulnerability. There are no known workarounds for this issue.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an Out-Of-Bounds Write in the `progressive_decompress` function. This issue is likely down to incorrect calculations of the `nXSrc` and `nYSrc` variables. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. there are no known workarounds for this vulnerability.