CVE-2023-40589

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2023-40589
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40589.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2023-40589
Aliases
  • GHSA-gc34-mw6m-g42x
Downstream
Related
Published
2023-08-31T18:31:07.355Z
Modified
2026-07-09T10:58:36.250623Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L CVSS Calculator
Summary
FreeRDP Global-Buffer-Overflow in ncrush_decompress
Details

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/40xxx/CVE-2023-40589.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-120"
    ]
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
1384b3c33b9bd7599633cc54bf20cf20ec6be83c
Introduced
f468a06d88c55b9ed484757326a9528cf27d33f4
Fixed
16141a30f983dd6f7a6e5b0356084171942c9416
Database specific 
{
    "source": [
        "CPE_RANGE",
        "CPE_STRING",
        "REFERENCES"
    ],
    "cpe": [
        "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:freerdp:freerdp:3.0.0:beta1:*:*:*:*:*:*",
        "cpe:2.3:a:freerdp:freerdp:3.0.0:beta2:*:*:*:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.11.0"
        },
        {
            "introduced": "3.0.0-beta1"
        },
        {
            "last_affected": "3.0.0-beta1"
        },
        {
            "introduced": "3.0.0-beta2"
        },
        {
            "last_affected": "3.0.0-beta2"
        }
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
2.1.0
2.1.1
2.1.2
2.10.0
2.2.0
2.3.0
2.3.1
2.3.2
2.4.1
2.5.0
2.6.0
2.6.1
2.7.0
2.8.0
2.8.1
2.9.0
3.*
3.0.0-beta1
3.0.0-beta2

Database specific

vanir_signatures_modified 
"2026-07-09T10:58:36Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-40589.json"
vanir_signatures 
[
    {
        "id": "CVE-2023-40589-2115e29b",
        "digest": {
            "function_hash": "38397887250772853898587036776486652560",
            "length": 4572.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/freerdp/freerdp/commit/16141a30f983dd6f7a6e5b0356084171942c9416",
        "deprecated": false,
        "target": {
            "function": "ncrush_decompress",
            "file": "libfreerdp/codec/ncrush.c"
        }
    },
    {
        "id": "CVE-2023-40589-6ed79801",
        "digest": {
            "function_hash": "141444434219220471721022567228171365324",
            "length": 5812.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/freerdp/freerdp/commit/16141a30f983dd6f7a6e5b0356084171942c9416",
        "deprecated": false,
        "target": {
            "function": "ncrush_compress",
            "file": "libfreerdp/codec/ncrush.c"
        }
    },
    {
        "id": "CVE-2023-40589-f480f998",
        "digest": {
            "function_hash": "66834350508458942252331492645745734300",
            "length": 944.0
        },
        "signature_version": "v1",
        "signature_type": "Function",
        "source": "https://github.com/freerdp/freerdp/commit/16141a30f983dd6f7a6e5b0356084171942c9416",
        "deprecated": false,
        "target": {
            "function": "ncrush_generate_tables",
            "file": "libfreerdp/codec/ncrush.c"
        }
    },
    {
        "id": "CVE-2023-40589-fce9c379",
        "digest": {
            "line_hashes": [
                "39491761018321989340588217796835759577",
                "47644992046955873321745992591815745437",
                "194391125687827433712690339792692834398",
                "20005509950726800398380258710048440803",
                "282422788161900798191212969205648141184",
                "184243668578218768817052029929290983585",
                "58108791010646197013406395074885596352",
                "324468747651136309761102535385579748570",
                "249038247607369877474922323045943130996",
                "323068128292311577725969455017219638497",
                "201031537773696687991955042031559351711",
                "288353389737179897876601744156513871885",
                "210267880645722472575406213598723716569",
                "184540925736074225215979751522597814016",
                "123284517684415278817356919750511576037",
                "223237839863700903691134111076443267581",
                "332441973939335590331652934266508031274",
                "280712115152907946167616805410269124990",
                "215409339012245343295706766839065458531",
                "136425218355664893749766171243459094638",
                "194816313710249818004880173399731400600",
                "327884646530588348567584063294609506746",
                "166351164147049349483842038030224844407",
                "896208940573419476283842348433883253",
                "66014244141323048569005195134481250077",
                "252551247629420547786136428282368578582",
                "134868974477737692680547640612497257042",
                "307906602450403131999634813412408717275",
                "160543828050098470220605496698823889384",
                "156686614319405768709433269151695744732",
                "69930150712426046549648547009876753003",
                "269004093768846647653457594679110489404",
                "175568537785912624911832783851875813478",
                "18012614319556151622793263159533146338",
                "201693277248811474189007679619859964408",
                "337241630607291439793158626783838315535",
                "1146705334128855766943307478338777344",
                "163881931847946375390256907898566314660",
                "72194329756188357821204036686893702309",
                "213864205817561423132269665335491871470",
                "313199457983855493002079749900230438087",
                "130729499570842910118538815932253542908",
                "220388204399288169390214405013987345497",
                "187076408441256040762552393345149367362",
                "294981652759220855375113653658351334837",
                "158768888658595912896897809571987216362",
                "123779975471602487635190217805958270885",
                "198060274794703221211480599288367343686",
                "306983527283829713748040298731921482659",
                "301822397519617189051420825412845438608",
                "208435371216812281079169716480552846516",
                "339562693820875774157682001304162780258",
                "114264579377123824099331291269826729701",
                "190596178472555966904138615858115370891",
                "55948852002865878385484141891956508924",
                "211904699816732316835507418242671207658",
                "82600220485988310296918689751067314080",
                "90433035205480124080437801957452422664",
                "91936374633524052483236606124456108360",
                "132561192363442929674710163218619301708",
                "12827013595305589946409343513887455629",
                "54466035927076405890479542258855200080",
                "29653016791198094106802133576289300581",
                "170917972006656202822869347936260340446",
                "246412633901925130160384533647990292045",
                "170083958389956615353375958470082365056",
                "320623343299698782913277774675659204274",
                "113212888751825142351806468120761986727",
                "219913406311819660845039470109486510967",
                "187076408441256040762552393345149367362",
                "294981652759220855375113653658351334837",
                "158768888658595912896897809571987216362",
                "123779975471602487635190217805958270885",
                "198060274794703221211480599288367343686",
                "306983527283829713748040298731921482659",
                "301822397519617189051420825412845438608",
                "208435371216812281079169716480552846516",
                "339562693820875774157682001304162780258",
                "114264579377123824099331291269826729701",
                "190596178472555966904138615858115370891",
                "49041198670706611563105458266415809347",
                "90841630330552192179589994633135904480",
                "94990902979555508229884758460240140504",
                "133142439622873534678488344769676534954",
                "189398940369358021516594060164954337770",
                "321005020825509057175588435100660404542",
                "237205615288117764276131858730559066684",
                "199111329050982258157299469450402748996",
                "5870444989282350133031745313744533234",
                "195287259988968967975890426836925381884",
                "216911109883335643184837607144947185155",
                "128094225490893019075380446554798751913",
                "24639927015344435543796831067467654678",
                "262879245910207600681072848618392086013",
                "126597793910619855300101532233375471406",
                "294367618023747031794097497966505517711",
                "64734852372285275113452531409525971736",
                "290009660869826643823462822816379181875",
                "299350357464501597602654579766042433639",
                "170567797171251449882638548003665961127",
                "111850640847911910987320456691890074399",
                "222529768191514564748928350153928531203",
                "312148365934925994341925758798361500471",
                "149795144914093028783246615240491715468",
                "210347917806968167468499873391082357496",
                "103553547388611865596944945940056167692",
                "24639927015344435543796831067467654678",
                "262879245910207600681072848618392086013",
                "126597793910619855300101532233375471406",
                "294367618023747031794097497966505517711",
                "64734852372285275113452531409525971736",
                "290009660869826643823462822816379181875",
                "299350357464501597602654579766042433639",
                "219908176874569581531307285925322771429",
                "173397191211235368050998037437903641777",
                "180518647716494305579076129692268195993",
                "118569290029823002671615199527432437473",
                "64381496795755673732518615181918290146",
                "133142439622873534678488344769676534954",
                "309186898540731685337686835460725075342",
                "177351968389766351889309048131105061624",
                "54616864953942031604127980730402918718",
                "320396930495005161922418114790507306765",
                "81595577221857923181177233452618263272",
                "158862777618866534523731561631007390273",
                "2424863159876019365058704062028787674"
            ],
            "threshold": 0.9
        },
        "signature_version": "v1",
        "signature_type": "Line",
        "source": "https://github.com/freerdp/freerdp/commit/16141a30f983dd6f7a6e5b0356084171942c9416",
        "deprecated": false,
        "target": {
            "file": "libfreerdp/codec/ncrush.c"
        }
    }
]