CVE-2023-39354

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 2.11.0 FreeRDP versions prior to 3.0.0-beta3

Description The issue is related to an Out-Of-Bounds Read in the nsc rle decompress data function. This occurs because the function processes context->Planes without checking if it contains data of sufficient length. An attacker may be able to cause a crash by leveraging this vulnerability.

Recommendations For versions prior to 2.11.0, upgrade to version 2.11.0 or later. For versions prior to 3.0.0-beta3, upgrade to version 3.0.0-beta3 or later. As a temporary workaround, consider disabling the nsc rle decompress data function until a patch is available.