CVE-2022-39316

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.9.0

Description The issue is related to an out of bound read in the ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it, likely resulting in a crash. The vulnerability can be exploited by a remote attacker to cause a denial of service.

Recommendations For versions prior to 2.9.0, upgrade to version 2.9.0 or later to address the issue. As a temporary workaround, consider restricting access to the ZGFX decoder component until a patch is available.