CVE-2023-39352
Publication date 31 August 2023
Last updated 4 August 2025
Ubuntu priority
Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an invalid offset validation leading to Out Of Bound Write. This can be triggered when the values `rect->left` and `rect->top` are exactly equal to `surface->width` and `surface->height`. eg. `rect->left` == `surface->width` && `rect->top` == `surface->height`. In practice this should cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| freerdp2 | ||
| 22.04 LTS jammy |
Fixed 2.6.1+dfsg1-3ubuntu2.5
|
|
| 20.04 LTS focal |
Fixed 2.2.0+dfsg1-0ubuntu0.20.04.6
|
|
| 18.04 LTS bionic |
Fixed 2.2.0+dfsg1-0ubuntu0.18.04.4+esm2
|
|
| 16.04 LTS xenial | Ignored end of standard support | |
| 14.04 LTS trusty | Ignored end of standard support |
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
9.8 · Critical
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Related Ubuntu Security Notices (USN)
- USN-6522-1
- FreeRDP vulnerabilities
- 29 November 2023
- USN-6522-2
- FreeRDP vulnerabilities
- 7 December 2023