CVE-2020-4033

MEDIUM 6.5CVE-2020-4033 · Published 22/06/2020 · updated 17/06/2026

In short

CVE-2020-4033 is a MEDIUM (CVSS 6.5) vulnerability affecting freerdp (freerdp).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.1% of all vulnerabilities.
Fix: update to 2.1.2 or later.

Package	Affected versions	Patched versions
freerdp freerdp	`< 2.1.2`	`2.1.2`

Description

In FreeRDP before version 2.1.2, there is an out of bounds read in RLEDECOMPRESS. All FreeRDP based clients with sessions with color depth < 32 are affected. This is fixed in version 2.1.2.

References

lists.opensuse.org/opensuse-security-announce/2020-07/msg00080.html · Mailing List
freerdp.com/2020/06/22/2_1_2-released · Release Notes
FreeRDP/FreeRDP commit 0a98c45 · Patch
FreeRDP/FreeRDP security advisory · Mitigation
lists.debian.org/debian-lts-announce/2023/10/msg00008.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6Y35HBHG2INICLSGCIKNAR7GCXEHQACQ
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOZLH35OJWIQLM7FYDXAP2EAUBDXE76V
usn.ubuntu.com/4481-1 · Third Party Advisory

More vulnerabilities in freerdp

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

freerdp

< 2.1.2

2.1.2

More vulnerabilities in freerdp

See all →