Skip to content
Fencer Vulns
medium 6.5

CVE-2018-1000852 json

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in…

published 2018-12-20 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-2039

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.7%
EPSS 2.7% chance of exploitation in 30 days, percentile 85%
public exploits
0
none known

Summary

FreeRDP FreeRDP 2.0.0-rc3 released version before commit 205c612820dac644d665b5bb1cdf437dc5ca01e3 contains a Other/Unknown vulnerability in channels/drdynvc/client/drdynvc_main.c, drdynvc_process_capability_request that can result in The RDP server can read the client's memory.. This attack appear to be exploitable via RDPClient must connect the rdp server with echo option. This vulnerability appears to have been fixed in after commit 205c612820dac644d665b5bb1cdf437dc5ca01e3.

Patch / fix

  • freerdp freerdp 2.0.0
  • freerdp2 Debian 12 2.0.0~git20181120.1.e21b72c95+dfsg1-1

debian advisories DEBIAN-CVE-2018-1000852

  • freerdp2 Ubuntu 18.04 LTS 2.1.1+dfsg1-0ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2018-1000852

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • freerdp RHEL 7 2.0.0-1.rc4.el7
  • vinagre RHEL 7 3.22.0-12.el7
  • libwinpr RHEL 7 2.0.0-1.rc4.el7
  • freerdp-libs RHEL 7 2.0.0-1.rc4.el7

red hat advisories RHSA-2019:2157

  • freerdp SLE Workstation Extension 12 SP5, SLE Software Development Kit 12 SP5 2.1.2-12.20.1
  • vinagre SLE Workstation Extension 12 SP5 3.20.2-16.3.3
  • freerdp SLE Workstation Extension 15 2.0.0~rc4-3.3.1
  • freerdp SLED 12 SP4, SLED 12 SP3, SLE Workstation Extension 12 SP4 +3 more 2.0.0~git.1463131968.4e66df7-12.8.1

suse advisories SUSE-SU-2020:2272-1SUSE-SU-2019:0539-1SUSE-SU-2019:0134-1

  • freerdp2 openSUSE Tumbleweed 2.4.0-2.1

opensuse advisories openSUSE-SU-2024:10768-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-1000852 updated cvss 4.3

freerdp: out of bounds read in drdynvc_process_capability_request

  • Red Hat Enterprise Linux 6 freerdp, freerdp-libs, freerdp-plugins
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux Client (v. 7) vinagre 3.22.0-12.el7, freerdp 2.0.0-1.rc4.el7, libwinpr 2.0.0-1.rc4.el7, freerdp-libs 2.0.0-1.rc4.el7 Red Hat Enterprise Linux Client Optional (v. 7) freerdp-devel 2.0.0-1.rc4.el7, libwinpr-devel 2.0.0-1.rc4.el7, freerdp-debuginfo 2.0.0-1.rc4.el7 Red Hat Enterprise Linux Server (v. 7) vinagre 3.22.0-12.el7, freerdp 2.0.0-1.rc4.el7, libwinpr 2.0.0-1.rc4.el7, freerdp-libs 2.0.0-1.rc4.el7 Red Hat Enterprise Linux Server Optional (v. 7) freerdp-devel 2.0.0-1.rc4.el7, libwinpr-devel 2.0.0-1.rc4.el7, freerdp-debuginfo 2.0.0-1.rc4.el7 Red Hat Enterprise Linux Workstation (v. 7) vinagre 3.22.0-12.el7, freerdp 2.0.0-1.rc4.el7, libwinpr 2.0.0-1.rc4.el7, freerdp-libs 2.0.0-1.rc4.el7 Red Hat Enterprise Linux Workstation Optional (v. 7) freerdp-devel 2.0.0-1.rc4.el7, libwinpr-devel 2.0.0-1.rc4.el7, freerdp-debuginfo 2.0.0-1.rc4.el7
    fixed: vendor fix RHSA-2019:2157
  • Red Hat Enterprise Linux 8 freerdp, libwinpr, freerdp-libs
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

2.67% chance of exploitation in the next 30 days, higher than 85% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/FreeRDP/FreeRDP/issues/4866 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.