CVE-2022-39283: fedoraproject fedora Out-of-bounds Read
Vulnerability summary
CVE-2022-39283 is a high (CVSS 7.5) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 1.37% chance of exploitation in the next 30 days, higher than 71.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 10 · Related 5Timeline
- 12-10-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
FreeRDP is a free remote desktop protocol library and clients. All FreeRDP based clients when using the `/video` command line switch might read uninitialized data, decode it as audio/video and display the result. FreeRDP based server implementations are not affected. This issue has been patched in version 2.8.1. If you cannot upgrade do not use the `/video` switch.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
1.37%
Chance of exploitation in the next 30 days
Percentile
72%
Versus all other CVEs
30-day change
+0.27 pp
From 1.10% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- freerdpAll versions (No fix recorded)
- freerdp2< 2.2.0+dfsg1-0ubuntu0.18.04.4 | < 2.2.0+dfsg1-0ubuntu0.20.04.4 | < 2.6.1+dfsg1-3ubuntu2.3
Debian1 product
- freerdp2< 2.8.1+dfsg1-1
Fedoraproject1 product
- fedoraEOL35 | 36 | 37
Freerdp1 product
- freerdp≤ 2.8.0 | < 2.8.1
4 vendors · 5 products
References
12 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
