CVE-2020-11048

LOW 2.2CVE-2020-11048 · Published 07/05/2020 · updated 17/06/2026

In short

CVE-2020-11048 is a LOW (CVSS 2.2) vulnerability affecting freerdp (freerdp).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 79.1% of all vulnerabilities.
Fix: update to 2.0.0 or later.

Package	Affected versions	Patched versions
freerdp freerdp	`≥ 1.0.0, < 2.0.0`	`2.0.0`

Description

In FreeRDP after 1.0 and before 2.0.0, there is an out-of-bounds read. It only allows to abort a session. No data extraction is possible. This has been fixed in 2.0.0.

References

FreeRDP/FreeRDP commit 9301bfe · Patch
FreeRDP/FreeRDP · Exploit
FreeRDP/FreeRDP security advisory · Third Party Advisory
lists.debian.org/debian-lts-announce/2020/08/msg00054.html · Third Party Advisory
lists.debian.org/debian-lts-announce/2023/10/msg00008.html · Mailing List
usn.ubuntu.com/4379-1 · Third Party Advisory
usn.ubuntu.com/4382-1 · Third Party Advisory

More vulnerabilities in freerdp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

freerdp

≥ 1.0.0, < 2.0.0

2.0.0

More vulnerabilities in freerdp

See all →