CVE-2023-39350

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-191

Affected software

No affected versions have been published.

Timeline

Published: Aug 31, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-393517.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are s CVE-2023-393529.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-393539.1FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-393547.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to a CVE-2023-393559.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x rel CVE-2023-393569.1FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing off CVE-2023-393578.8Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the co CVE-2023-393588.8Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered w CVE-2023-393598.8Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered w CVE-2023-39366.1The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a R CVE-2023-393606.1Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-Scripting CVE-2023-393619.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered i