CVE-2023-40589

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. In affected versions there is a Global-Buffer-Overflow in the ncrush_decompress function. Feeding crafted input into this function can trigger the overflow which has only been shown to cause a crash. This issue has been addressed in versions 2.11.0 and 3.0.0-beta3. Users are advised to upgrade. There are no known workarounds for this issue.

• CWE-120

• https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42xExploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202401-16
• https://github.com/FreeRDP/FreeRDP/commit/16141a30f983dd6f7a6e5b0356084171942c9416Patch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-gc34-mw6m-g42xExploit, Vendor Advisory
• https://lists.debian.org/debian-lts-announce/2023/10/msg00008.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A6LLDAPEXRDJOM3PREDDD267SSNT77DP/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IHMTGKCZXJPQOR5ZD2I4GPDNP2DKRXMF/Mailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/OH2ATH2BKDNKCJAU4WPPXK4SHLE3UJUV/Mailing List, Third Party Advisory
• https://security.gentoo.org/glsa/202401-16

Published

Aug 31, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40583libp2p is a networking stack and library modularized out of …7.5
• CVE-2023-40584Argo CD is a declarative continuous deployment for Kubernete…6.5
• CVE-2023-40585ironic-image is a container image to run OpenStack Ironic as…7.5
• CVE-2023-40586OWASP Coraza WAF is a golang modsecurity compatible web appl…7.5
• CVE-2023-40587Pyramid is an open source Python web framework. A path trave…5.3
• CVE-2023-40588Discourse is an open-source discussion platform. Prior to ve…6.5
• CVE-2023-4059The Profile Builder WordPress plugin before 3.9.8 lacks auth…4.3
• CVE-2023-40590 GitPython is a python library used to interact with Git rep…7.8
• CVE-2023-40591go-ethereum (geth) is a golang execution layer implementatio…7.5
• CVE-2023-40592In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12…6.1
• CVE-2023-40593In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a…7.5
• CVE-2023-40594In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and …7.5