CVE-2022-39319 - CVE House
Back to Database
Status published Medium CVE-2022-39319

Missing length validation in urbdrc channel in FreeRDP

Vulnerability Description

FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A malicious server can trick a FreeRDP based client to read out of bound data and send it back to the server. This issue has been addressed in version 2.9.0 and all users are advised to upgrade. Users unable to upgrade should not use the `/usb` redirection switch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-39319

Credits & Attribution

No credits recorded in the NVD database.

References

More from FreeRDP

View All →
CVE-2025-68118
Potential Heap Out-of-Bounds Read in freerdp_certificate_data_hash_ via Unsafe _snprintf Usage
Medium 6.6
CVE-2024-32662
FreeRDP rdp_redirection_read_base64_wchar out of bound read
High 7.5
CVE-2024-32661
FreeRDP rdp_write_logon_info_v1 NULL access
High 7.5
CVE-2024-32660
FreeRDP zgfx_decompress out of memory vulnerability
High 7.5
CVE-2024-32659
freerdp_image_copy out of bound read
Critical 9.8

Affected Vendor

Affected Software

FreeRDP
Vulnerable Versions:
< 2.9.0

Timeline

Official Publish: November 16th, 2022
Last Modified: November 3rd, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L

Weaknesses (CWE)

CWE-125

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1213 Data from Information Repositories
Collection
T1003 OS Credential Dumping
Credential Access
T1552 Unsecured Credentials
Credential Access