High
Security advisory
HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-17178
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:26 UTC · Revision 1
Source evidence
HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.
osv:CVE-2019-17178
Complete source record
{
"id": "d6bcb808ac61d8e885e71f9694c312cf9e020d4fa5f550520f33ba2fcc6aba0f",
"url": "https://osv.dev/vulnerability/CVE-2019-17178",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-17178",
"summary": "HuffmanTree_makeFromFrequencies in lodepng.c in LodePNG through 2019-09-28, as used in WinPR in FreeRDP and other products, has a memory leak because a supplied realloc pointer (i.e., the first argument to realloc) is also used for a realloc return value.",
"evidence": "osv:CVE-2019-17178",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-17178",
"aliases": [
"CVE-2019-17178"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/freerdp/freerdp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "616aed4ec2889f379b9d1e840230d9a33cda8bf0"
},
{
"introduced": "1be90abcb9440b6f14b3fca4d7b462d9b3ce6432"
},
{
"last_affected": "1be90abcb9440b6f14b3fca4d7b462d9b3ce6432"
},
{
"fixed": "9fee4ae076b1ec97b97efb79ece08d1dab4df29a"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.0.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:freerdp:freerdp:1.1.0:beta1:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.0-beta1"
},
{
"last_affected": "1.1.0-beta1"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "9fee4ae076b1ec97b97efb79ece08d1dab4df29a"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"1.1.0-beta1",
"1.0.2",
"1.0.2-rc2",
"1.0.2-rc1",
"1.0.1",
"1.0.0",
"1.0-beta5",
"1.0-beta4",
"1.0-beta2",
"1.0-beta1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-17178.json",
"vanir_signatures": [
{
"id": "CVE-2019-17178-4f8c096a",
"digest": {
"threshold": 0.9,
"line_hashes": [
"269215551196728372072229002611498048274",
"60882436054191971992951776647637498497",
"246423792840165743178928287324492503526",
"186775369845774264331823368553861729311",
"121033979759465712227962233428386596536",
"333459367581250853282024688279097815294",
"52652199316993592414430078609399706190",
"281242411092693082450489738599220562788",
"293078200095957182578457349885119669019"
]
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "winpr/libwinpr/utils/lodepng/lodepng.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-17178-7ec9b5d0",
"digest": {
"length": 2318,
"function_hash": "111556578513038953191829364359908659521"
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "client/X11/generate_argument_docbook.c",
"function": "tr_esc_str"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-17178-80fe4fbc",
"digest": {
"length": 1417,
"function_hash": "238058498232279513812602263336545750696"
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "libfreerdp/codec/region.c",
"function": "region16_intersect_rect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-17178-9e923a88",
"digest": {
"length": 910,
"function_hash": "182161999730597109211945894636287786661"
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "libfreerdp/codec/region.c",
"function": "region16_simplify_bands"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-17178-b16b382d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"169942117269173459854457627031907093168",
"192678371756632553035970616533493584616",
"67712262644008916266627221126531232786",
"111352148105322516270348382852283456869",
"68688189215770436792667200383767070546",
"120400749965676790911622306983534637449",
"337960107116802670648657492232181897010",
"115590768827935740976323704459018392382",
"19501158130532074895777220320136227012",
"222911646423814009956664567931908529052",
"314707534127468225231502214208236632670",
"176978620197884198033439116035680797325",
"232962076676134982586978795924198445130",
"54923070188309183671310197226108892649",
"314707534127468225231502214208236632670",
"176978620197884198033439116035680797325",
"161703410555354982306830631585466092817",
"278765345449261648401903298331054283307",
"90260239477347542038201787329833467610",
"176978620197884198033439116035680797325",
"244861578303904110441648214358557235912",
"83582483396781978813770731794463705285",
"90260239477347542038201787329833467610",
"176978620197884198033439116035680797325",
"313217851107018138835367919458041581201",
"216904702782556537822758554598757525054",
"148190799425122740469724662021157560141",
"176978620197884198033439116035680797325"
]
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "client/X11/generate_argument_docbook.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-17178-bc572671",
"digest": {
"length": 2888,
"function_hash": "153710806257076984915596454631468483510"
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "libfreerdp/codec/region.c",
"function": "region16_union_rect"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-17178-fd5cbcf7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"236789859763925190122086759330866475518",
"303447436975685695637060891267598298600",
"238855805430459233328977818012291901312",
"320151404832153686982822229424724071681",
"306277995164946684417977004325037077541",
"321893086654608489648272653389745040833",
"320334514659870503550670014781451630788",
"269239849473155655800555847669994911240",
"116891536248283089850423111705276134785",
"110177783688515234290913881762732141893",
"238100245164064885829079799523851780215",
"11546404366772640448671224959801578622",
"31636775941089041245965245234738855235",
"300596855173215564464195492167778391485",
"100368184650351677725721506535300695529",
"143839062400987009432695694937797317323",
"111849370724169758773020147272706896899",
"225149152969146341033887566919266056394",
"17200948198447921021291136443610520655",
"288041447184418308804384182739267874627",
"14946096756773680099055441873743711075"
]
},
"source": "https://github.com/freerdp/freerdp/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a",
"target": {
"file": "libfreerdp/codec/region.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:33:50Z"
}
}
],
"modified": "2026-10-20T13:33:50.679344972Z",
"provider": "osv",
"references": [
"https://github.com/FreeRDP/FreeRDP/issues/5645",
"https://github.com/FreeRDP/FreeRDP/commit/9fee4ae076b1ec97b97efb79ece08d1dab4df29a"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:lodev:lodepng:*:*:*:*:*:*:*:*"
],
"vendor_product": "lodev:lodepng",
"extracted_events": [
{
"range": [
{
"last_affected": "2019-09-28"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "15.0"
},
{
"last_affected": "15.0"
},
{
"introduced": "15.1"
},
{
"last_affected": "15.1"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2019-17178",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387834,
"published_at": "2019-10-04T17:15:10.067+00:00"
}