Invalid offset validation leading to Out Of Bound Write in FreeRDP

CVE-2023-39352

What is CVE-2023-39352?

The vulnerability in FreeRDP stems from an invalid offset validation that may lead to an Out Of Bound Write. This is triggered under specific conditions when rect->left equals surface->width and rect->top equals surface->height. Such conditions can lead to application instability, potentially causing crashes. It is strongly recommended that users upgrade to FreeRDP versions 2.11.0 or 3.0.0-beta3 to mitigate this issue, as no workarounds are available.

References