What’s Vulnerable › Vulnerabilities

CVE-2020-4030: OOB read in `TrioParse` in FreeRDP

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2020-06-22 · updated 2026-06-17
• Weakness: CWE-125

Description

In FreeRDP before version 2.1.2, there is an out of bounds read in TrioParse. Logging might bypass string length checks due to an integer overflow. This is fixed in version 2.1.2.

Affected products

• Canonical Ubuntu Linux: 18.04, 20.04
• Debian Linux: 10.0
• Fedoraproject Fedora: 31, 32
• FreeRDP: before 2.1.2 — fixed in 2.1.2
• openSUSE Leap: 15.1

How to fix

Upgrade to a fixed version: FreeRDP 2.1.2. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
• http://www.freerdp.com/2020/06/22/2_1_2-released
• https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V/
• https://usn.ubuntu.com/4481-1/
• http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html
• http://www.freerdp.com/2020/06/22/2_1_2-released
• https://github.com/FreeRDP/FreeRDP/commit/05cd9ea2290d23931f615c1b004d4b2e69074e27
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-fjr5-97f5-qq98

Get alerted when CVE-2020-4030 or the next vulnerability affects your stack