CVE-2023-42822: Unchecked access to font glyph info in xrdp
Last updated 26 June 2026
Other sources
xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdppainter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/xrdpto a version that resolves this vulnerability.Fixed in 0.9.21.1-1~deb11u3Fixed in 0.9.21.1-1+deb12u2Fixed in 0.10.1-3.1+deb13u1Fixed in 0.10.5-5Fixed in 0.10.6-5 - Upgrade
Upgrade
xrdpto a version that resolves this vulnerability.Fixed in 0.9.23.1
Event History
Frequently Asked Questions
What is CVE-2023-42822?
CVE-2023-42822 is a vulnerability in the xrdp remote desktop protocol server that allows an out-of-bounds read within the xrdp executable.
What is the severity of CVE-2023-42822?
The severity of CVE-2023-42822 is medium, with a severity value of 6.5.
How does CVE-2023-42822 affect xrdp?
CVE-2023-42822 affects xrdp versions up to and excluding 0.9.23.1, specifically in the xrdp_painter.c file where access to font glyphs is not bounds-checked, leading to an out-of-bounds read within the xrdp executable.
How can I fix CVE-2023-42822?
To fix CVE-2023-42822, it is recommended to update xrdp to version 0.9.23.1 or newer, which includes a patch for this vulnerability.
Where can I find more information about CVE-2023-42822?
More information about CVE-2023-42822 can be found in the GitHub commit and security advisory, as well as the Fedora Project announcement linked in the references.