CVE catalog
CVE-2023-40187
freerdp2: CVE-2023-40187
- Severity
- Low
- Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.16% · Oct 25, 2026
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. Affected versions of the 3.x beta branch are subject to a Use-After-Free issue in the `avc420_ensure_buffer` and `avc444_ensure_buffer` functions. If the value of `piDstSize[x]` is 0, `ppYUVDstData[x]` will be freed. However, in this case `ppYUVDstData[x]` will not have been updated which leads to a Use-After-Free vulnerability. This issue has been addressed in version 3.0.0-beta3. Users of the 3.x beta releases are advised to upgrade. There are no known workarounds for this vulnerability.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | freerdp2 | bookworm | 2.11.7+dfsg1-6~deb12u1 | not affected |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | freerdp2 | source | bookworm | Not affected | unimportant | Not reported | Not reported |
OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
References
- [https://osv.dev/vulnerability/UBUNTU-CVE-2023-40187]
- [https://security-tracker.debian.org/tracker/CVE-2023-40187]
- [https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2251.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]