CVE-2022-39282— RDP client: Read of uninitialized memory with parallel port redirection
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP是FreeRDP团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP 2.8.1之前版本存在安全漏洞，该漏洞源于在unix系统上基于FreeRDP的客户端使用/parallel命令行开关可能会读取未初始化的数据并将其发送到客户端当前连接的服务器。
Possible ATT&CK Techniques 1 AI
T1213 · Data from Information Repositories
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-39282
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
RDP client: Read of uninitialized memory with parallel port redirection
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP is a free remote desktop protocol library and clients. FreeRDP based clients on unix systems using `/parallel` command line switch might read uninitialized data and send it to the server the client is currently connected to. FreeRDP based server implementations are not affected. Please upgrade to 2.8.1 where this issue is patched. If unable to upgrade, do not use parallel port redirection (`/parallel` command line switch) as a workaround.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5
Vulnerability Title
FreeRDP 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeRDP是FreeRDP团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP 2.8.1之前版本存在安全漏洞，该漏洞源于在unix系统上基于FreeRDP的客户端使用/parallel命令行开关可能会读取未初始化的数据并将其发送到客户端当前连接的服务器。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-39282
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-39282
请登录查看更多情报信息。
Vendor Advisories for CVE-2022-39282 (2)
-
https://security.gentoo.org/glsa/202210-24 vendor-advisory
Mailing List Discussions for CVE-2022-39282 (4)
Other References for CVE-2022-39282 (1)
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-91963
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Discl -
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-91962
FreeRDP before 3.31.0 Integer Overflow via audin Apple backe -
CVE-2026-91960
FreeRDP before 3.31.0 Integer Overflow Double Free -
CVE-2026-91961
FreeRDP before 3.31.0 Denial of Service via URBDRC
Same vendor: FreeRDP
-
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-91963
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Discl -
CVE-2026-91962
FreeRDP before 3.31.0 Integer Overflow via audin Apple backe -
CVE-2026-91960
FreeRDP before 3.31.0 Integer Overflow Double Free -
CVE-2026-91961
FreeRDP before 3.31.0 Denial of Service via URBDRC
Same weakness: CWE-908
-
CVE-2026-107676
FFmpeg through 9.0.2 Uninitialized Memory Disclosure via HDR -
CVE-2026-104074
Coturn 4.10.0 Uninitialized Stack Memory Disclosure via ERRO -
CVE-2026-106275
Chrome Android<155.0.8059.39内存越界漏洞 -
CVE-2026-106386
Chrome <155.0.8059.39 内存越界读取漏洞 -
CVE-2026-106395
Chrome < 155.0.8059.39 Android未初始化资源内存读取漏洞
V. Comments for CVE-2022-39282
No comments yet