Skip to main content

Integer Overflow or Wraparound

CVE-2023-40186

High
9.8/10

Summary

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to an IntegerOverflow leading to Out-of-bounds Write vulnerability in the `gdi_CreateSurface` function. This issue affects FreeRDP based clients only. FreeRDP proxies are not affected as image decoding is not done by a proxy. This vulnerability affects FreeRDP versions through 2.10.0, and 3.0.0-beta1 through 3.0.0-beta2. Users are advised to upgrade. There are no known workarounds for this issue.

  • LOW
  • NETWORK
  • HIGH
  • UNCHANGED
  • NONE
  • NONE
  • HIGH
  • HIGH

CWE-190 - Integer Overflow or Wraparound

The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.

References

Advisory Timeline

  • Published