CVE-2020-11040
freerdp: Out of bound access in clear_decompress_subcode_rlex
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 9, 2020
Updated · February 24, 2026
Description
In FreeRDP less than or equal to 2.0.0, there is an out-of-bound data read from memory in clear_decompress_subcode_rlex, visualized on screen as color. This has been patched in 2.1.0.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
The flaw can be mitigated by not running the freerdp client with the /gfx connection modes and/or not connecting to untrusted or compromised rdp servers.
CVSS / CWE
CVSS 3.1 · 2.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
CWE-125 · Out-of-bounds Read