CVE-2022-39318

MEDIUM

FreeRDP < 2.9.0 - Denial of Service via urbdrc Channel Input Validation

Title source: llm

Description

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

References (7)

Core 7

Core References

Mailing List

https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html

Patch, Third Party Advisory

https://github.com/FreeRDP/FreeRDP/commit/80adde17ddc4b596ed1dae0922a0c54ab3d4b8ea

View Patch ZIP pw:eip

Third Party Advisory

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-387j-8j96-7q35

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDOTAOJBCZKREZJPT6VZ25GESI5T6RBG/

Mailing List, Third Party Advisory vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YGQN3OWQNHSMWKOF4D35PF5ASKNLC74B/

Mailing List mailing-list

https://lists.debian.org/debian-lts-announce/2023/11/msg00010.html

Third Party Advisory vendor-advisory

https://security.gentoo.org/glsa/202401-16

Scores

CVSS v3 4.8

EPSS 0.0096

EPSS Percentile 56.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H

Details

CWE

CWE-369 CWE-20

Status published

Products (3)

fedoraproject/fedora 36

fedoraproject/fedora 37

freerdp/freerdp < 2.9.0

Published Nov 16, 2022

Tracked Since Feb 18, 2026