CVE-2023-39351

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of FreeRDP are subject to a Null Pointer Dereference leading a crash in the RemoteFX (rfx) handling. Inside the `rfx_process_message_tileset` function, the program allocates tiles using `rfx_allocate_tiles` for the number of numTiles. If the initialization process of tiles is not completed for various reasons, tiles will have a NULL pointer. Which may be accessed in further processing and would cause a program crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

VendorProductVersions
FreeRDPFreeRDP< 2.11.0; >= 3.0.0-beta1, < 3.0.0-beta3

References

Timeline

Published
Aug 31, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-393529.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to aCVE-2023-393539.1FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to aCVE-2023-393547.5FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions are subject to aCVE-2023-393559.8FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Versions of FreeRDP on the 3.x relCVE-2023-393569.1FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions a missing offCVE-2023-393578.8Cacti is an open source operational monitoring and fault management framework. A defect in the sql_save function was discovered. When the coCVE-2023-393588.8Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered wCVE-2023-393598.8Cacti is an open source operational monitoring and fault management framework. An authenticated SQL injection vulnerability was discovered wCVE-2023-39366.1The Blog2Social WordPress plugin before 7.2.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a RCVE-2023-393606.1Cacti is an open source operational monitoring and fault management framework.Affected versions are subject to a Stored Cross-Site-ScriptingCVE-2023-393619.8Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a SQL injection discovered iCVE-2023-393627.2Cacti is an open source operational monitoring and fault management framework. In Cacti 1.2.24, under certain conditions, an authenticated p
CVE-2023-39351: High severity, CVSS 7.5 | Vulnix