What’s Vulnerable › Vulnerabilities

CVE-2020-11038: Integer Overflow to Buffer Overflow in FreeRDP

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-05-29 · updated 2026-06-17
• Weakness: CWE-680

Description

In FreeRDP less than or equal to 2.0.0, an Integer Overflow to Buffer Overflow exists. When using /video redirection, a manipulated server can instruct the client to allocate a buffer with a smaller size than requested due to an integer overflow in size calculation. With later messages, the server can manipulate the client to write data out of bound to the previously allocated buffer. This has been patched in 2.1.0.

Affected products

• Debian Linux: 10.0
• FreeRDP: before 2.1.0 — fixed in 2.1.0
• openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: FreeRDP 2.1.0. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h25x-cqr6-fp6g
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-h25x-cqr6-fp6g
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html

Get alerted when CVE-2020-11038 or the next vulnerability affects your stack