CVE-2022-39316: fedoraproject fedora Out-of-bounds Read
Vulnerability summary
CVE-2022-39316 is a medium (CVSS 5.7) Out-of-bounds Read vulnerability in fedoraproject fedora. EPSS estimates a 1.06% chance of exploitation in the next 30 days, higher than 63.9% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 16-11-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malicious server can trick a FreeRDP based client to read out of bound data and try to decode it likely resulting in a crash. This issue has been addressed in the 2.9.0 release. Users are advised to upgrade.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA4.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated4.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.06%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.06% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Debian1 product
- freerdp2< 2.9.0+dfsg1-1
Fedoraproject1 product
- fedoraEOL36 | 37
Freerdp1 product
- freerdp< 2.9.0
Ubuntu1 product
- freerdp2< 2.2.0+dfsg1-0ubuntu0.18.04.4 | < 2.2.0+dfsg1-0ubuntu0.20.04.4 | < 2.6.1+dfsg1-3ubuntu2.3
4 vendors · 4 products
References
11 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202401-16Vendor Advisory