CVE-2023-40187

Summary

CVE-2023-40187 is a Use-After-Free vulnerability affecting the FreeRDP 3.x beta branch of the Remote Desktop Protocol (RDP) implementation. Specific functions, `avc420_ensure_buffer` and `avc444_ensure_buffer`, are the root cause. If `piDstSize[x]` is zero, `ppYUVDstData[x]` is freed, but in such cases, it has not been updated, leading to a Use-After-Free condition. No workarounds exist, and users of the 3.x beta releases are urged to upgrade to version 3.0.0-beta3 for mitigation.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.