CVE-2022-39318: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2022-39318 is a medium (CVSS 5.7) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 1.04% chance of exploitation in the next 30 days, higher than 63.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 4Timeline
- 16-11-2022PublishedVulnerability first disclosed.
- 03-11-2025Last modifiedVulnerability information updated.
Description
FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious server can trick a FreeRDP based client to crash with division by zero. This issue has been addressed in version 2.9.0. All users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.
CVSS metrics
4 scores · 4 sources · 1 version- CVE.orgCNA4.8MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · UbuntuEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.04%
Chance of exploitation in the next 30 days
Percentile
64%
Versus all other CVEs
30-day change
0.00 pp
From 1.04% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu2 products
- freerdpAll versions (No fix recorded)
- freerdp2< 2.2.0+dfsg1-0ubuntu0.18.04.4 | < 2.2.0+dfsg1-0ubuntu0.20.04.4 | < 2.6.1+dfsg1-3ubuntu2.3
Debian1 product
- freerdp2< 2.9.0+dfsg1-1
Fedoraproject1 product
- fedoraEOL36 | 37
Freerdp1 product
- freerdp< 2.9.0
4 vendors · 5 products
References
11 links- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- security.gentoo.org/glsa/202401-16Vendor Advisory