CVE-2020-11040: Out-of-bounds Read in FreeRDP

CVE-2020-11040 PUBLISHED CVSS 2.2 LOW

Out-of-bounds Read in FreeRDP

Reported by github_m · Published May 29, 2020

In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.

Risk scores

CVSS 3.1

2.2

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L

Affected products

Vendor	Product	Versions
FreeRDP	FreeRDP	<= 2.0.0
FreeRDP	FreeRDP	0

Timeline

May 29, 2020 CVE Published
May 30, 2020 PoC Published
Apr 14, 2021 EPSS Score (30 in total, the first dated here)
Aug 4, 2024 CVE Updated
Aug 10, 2026 Security Advisory (2 in total, the first dated here)
Sep 6, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2020-11040
vulnetix vdb fixes CVE-2020-11040

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2020-11040/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

openSUSE-SU-2020:1090 vendor-advisory
[debian-lts-announce] 20231007 [SECURITY] [DLA 3606-1] freerdp2 security update mailing-list

Look up in the Resolve Platform →