CVE-2023-39350— Incorrect offset calculation leading to denial of service in FreeRDP
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP是FreeRDP团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP 存在数字错误漏洞，该漏洞源于当提供的 blockLen 不足且未执行适当的长度验证时，会发生整数下溢，从而导致拒绝服务 (DOS) 漏洞。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-39350
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Incorrect offset calculation leading to denial of service in FreeRDP
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. This issue affects Clients only. Integer underflow leading to DOS (e.g. abort due to `WINPR_ASSERT` with default compilation flags). When an insufficient blockLen is provided, and proper length validation is not performed, an Integer Underflow occurs, leading to a Denial of Service (DOS) vulnerability. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
整数下溢(超界折返)
Source: CVE Program / CVE List V5
Vulnerability Title
FreeRDP 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
FreeRDP是FreeRDP团队的一款开源的远程桌面协议（RDP）的实现。 FreeRDP 存在数字错误漏洞，该漏洞源于当提供的 blockLen 不足且未执行适当的长度验证时，会发生整数下溢，从而导致拒绝服务 (DOS) 漏洞。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2023-39350
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-39350
请登录查看更多情报信息。
Patches & Fixes for CVE-2023-39350 (1)
Vendor Advisories for CVE-2023-39350 (1)
Mailing List Discussions for CVE-2023-39350 (4)
Same Patch Batch · FreeRDP · 2023-08-31 · 17 CVEs total
| CVE-2023-40187 | 7.3 HIGH | Use-After-Free in FreeRDP |
| CVE-2023-39355 | 7.0 HIGH | FreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICS |
| CVE-2023-40567 | 6.5 MEDIUM | Out-Of-Bounds Write in FreeRDP |
| CVE-2023-40569 | 6.5 MEDIUM | Out-Of-Bounds Write in FreeRDP |
| CVE-2023-40574 | 6.5 MEDIUM | Out-Of-Bounds Write in FreeRDP |
| CVE-2023-40186 | 6.5 MEDIUM | IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDP |
| CVE-2023-39354 | 5.9 MEDIUM | FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_data |
| CVE-2023-40576 | 5.3 MEDIUM | Out-Of-Bounds Read in FreeRDP |
| CVE-2023-40575 | 5.3 MEDIUM | Out-Of-Bounds Read in FreeRDP |
| CVE-2023-40188 | 5.3 MEDIUM | Out-Of-Bounds Read in FreeRDP |
| CVE-2023-40181 | 5.3 MEDIUM | Integer-Underflow leading to Out-Of-Bound Read in FreeRDP |
| CVE-2023-39356 | 5.3 MEDIUM | Missing offset validation leading to Out-of-Bounds Read in FreeRDP |
| CVE-2023-39352 | 5.3 MEDIUM | Invalid offset validation leading to Out Of Bound Write in FreeRDP |
| CVE-2023-39353 | 5.3 MEDIUM | Missing offset validation leading to Out Of Bound Read in FreeRDP |
| CVE-2023-39351 | 5.3 MEDIUM | FreeRDP Null Pointer Dereference leading denial of service |
| CVE-2023-40589 | 4.3 MEDIUM | FreeRDP Global-Buffer-Overflow in ncrush_decompress |
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-91963
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Discl -
CVE-2026-91962
FreeRDP before 3.31.0 Integer Overflow via audin Apple backe -
CVE-2026-91960
FreeRDP before 3.31.0 Integer Overflow Double Free -
CVE-2026-91961
FreeRDP before 3.31.0 Denial of Service via URBDRC
Same vendor: FreeRDP
-
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-91963
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Discl -
CVE-2026-91962
FreeRDP before 3.31.0 Integer Overflow via audin Apple backe -
CVE-2026-91960
FreeRDP before 3.31.0 Integer Overflow Double Free -
CVE-2026-91961
FreeRDP before 3.31.0 Denial of Service via URBDRC
Same weakness: CWE-191
-
CVE-2026-106429
Application denial of service via malformed KMS endpoint in -
CVE-2026-106437
Out-of-bounds read and write via undersized BSON buffer rese -
CVE-2026-107635
Dislocker through 0.7.3 Out-of-Bounds Heap Read via VMK/FVEK -
CVE-2026-107614
Integer underflow in TightVNC Server cursor shape trimming l -
CVE-2026-19186
Integer underflow in IEEE 802.15.4 frame decryption leads to
V. Comments for CVE-2023-39350
No comments yet