CVE-2024-32040
Assigner: GitHub_M
Published: 2024-04-22T20:36:45.439Z
State: PUBLISHED
title: FreeRDP vulnerable to integer underflow in nsc_rle_decode
problemTypes: descriptions: cweId: CWE-191
description: CWE-191: Integer Underflow (Wrap or Wraparound)
type: CWE
metrics: cvssV3_1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
affected: vendor: FreeRDP
product: FreeRDP
versions: version: >= 3.0.0, 3.5.0
status: affected
version: < 2.11.6
status: affected
descriptions: value: FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).
source: advisory: GHSA-23c5-cp23-h2h5
discovery: UNKNOWN