CVE-2023-42822 Unchecked access to font glyph info in xrdp

Medium 4.6 Published 27 Sep 2023 Updated 3 Nov 2025

An attacker can trigger an out-of-bounds read in xrdp, potentially leading to information disclosure or privilege escalation in privileged processes.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2023-42822?

CVE-2023-42822 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 27 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

xrdp is an open source remote desktop protocol server. Access to the font glyphs in xrdp_painter.c is not bounds-checked . Since some of this data is controllable by the user, this can result in an out-of-bounds read within the xrdp executable. The vulnerability allows an out-of-bounds read within a potentially privileged process. On non-Debian platforms, xrdp tends to run as root. Potentially an out-of-bounds write can follow the out-of-bounds read. There is no denial-of-service impact, providing xrdp is running in forking mode. This issue has been addressed in release 0.9.23.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-125

Which versions are affected by CVE-2023-42822?

It affects 2 products.

Linux distribution packages (4)

`xrdp` SUSE:Linux Enterprise Module for Basesystem 15 SP4	All versions	`0.9.13.1-150200.4.27.1`
`xrdp` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`0.9.13.1-150200.4.27.1`
`xrdp` openSUSE:Leap 15.4	All versions	`0.9.13.1-150200.4.27.1`
`xrdp` openSUSE:Leap 15.5	All versions	`0.9.13.1-150200.4.27.1`

Products include Fedoraproject Fedora, Neutrinolabs Xrdp.

How do I fix CVE-2023-42822?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2023-42822 being exploited?

There is no known exploitation of CVE-2023-42822 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2023-42822, GHSA-2hjx-rm4f-r9hw, MGASA-2023-0334, SUSE-SU-2023:4577-1, UBUNTU-CVE-2023-42822.