CVE-2022-39316: Out of bound read in FreeRDP
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2022-39316?
CVE-2022-39316 is a vulnerability in the ZGFX decoder component of FreeRDP, a free remote desktop protocol library and clients.
How does CVE-2022-39316 impact FreeRDP?
CVE-2022-39316 allows a malicious server to trick a FreeRDP client into reading out-of-bound data and attempting to decode it, which can lead to a crash.
What is the severity of CVE-2022-39316?
CVE-2022-39316 has a severity rating of medium with a CVSS score of 5.7.
Which versions of FreeRDP are affected by CVE-2022-39316?
Versions of FreeRDP up to but excluding 2.9.0 are affected by CVE-2022-39316.
How can I fix CVE-2022-39316?
To fix CVE-2022-39316, update to a version of FreeRDP that is not vulnerable or apply the necessary patches provided by the vendor.