CVE-2022-39317 MEDIUM

CVE-2022-39317: Out of bounds read in zgfx decoder in FreeRDP

Vendor Freerdp

Product FreeRDP

Weakness CWE-125

Published November 16, 2022

Last update April 23, 2025

View on NVD All CVEs

CVSS base score

4.6/10

Attack vector Network

Attack complexity High

Privileges required Low

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

What the vulnerability does

01Description

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it. This issue has been addressed in version 2.9.0. There are no known workarounds for this issue.

Key dates

02Disclosure timeline

November 16, 2022 CVE published

April 23, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-39317 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/125.html

Related vulnerabilities

04Related CVE

CVE-2026-9263 Out-of-bounds read in Bluetooth Controller ISOAL framed RX reassembly leaks adjacent memory into host HCI ISO packets CVE-2026-54908 Pion DTLS: Denial of service via panic while parsing a crafted ECDHE_PSK ServerKeyExchange message CVE-2026-48770 Notepad++ WM_COPYDATA COPYDATA_FULL_CMDLINE local DoS crash CVE-2026-42326 ImageMagick: Heap Buffer Over-Read in IPTC encoder CVE-2025-7017 Avira antivirus engine heap buffer OOB read when scanning a malformed Windows MSI file