Freerdp · Freerdp · CVE-2023-39353
**Name of the Vulnerable Software and Affected Versions**
FreeRDP versions prior to 2.11.0
FreeRDP versions prior to 3.0.0-beta3
**Description**
The issue is related to a missing offset validation in the `libfreerdp/codec/rfx.c` file, specifically in `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr`. This can lead to an out of bounds read access, causing a crash when crafted input is processed. The vulnerability can be exploited by a remote attacker to cause a denial of service.
**Recommendations**
For FreeRDP versions prior to 2.11.0, upgrade to version 2.11.0 or later.
For FreeRDP versions prior to 3.0.0-beta3, upgrade to version 3.0.0-beta3 or later.
As a temporary workaround, consider restricting access to the `libfreerdp/codec/rfx.c` file until a patch is available.
Avoid using the parameters `tile->quantIdxY`, `tile->quantIdxCb`, and `tile->quantIdxCr` in the affected code until the issue is resolved.