CVE-2023-40589

MediumCVSS 4.3

Published: 31/08/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.20%

64th percentile - higher than 64% of all known CVEs

Summary

FreeRDP has a Global-Buffer-Overflow vulnerability in the ncrush_decompress function, which can be triggered by crafted input. This issue causes application crashes and has been addressed in versions 2.11.0 and 3.0.0-beta3.

Risk Assessment

Organizations using affected versions of FreeRDP may experience system crashes, leading to downtime of remote desktop services.

Recommendation

It is recommended to upgrade to versions 2.11.0 or 3.0.0-beta3 to mitigate this vulnerability.

Original NVD description (English source)

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.