CVE-2023-30576: Apache Guacamole

High severity, CVSS 8.1. EPSS: 1.1% chance of exploitation in the next 30 days.

Apache Guacamole 0.9.10 through 1.5.1 may continue to reference a freed RDP audio input buffer. Depending on timing, this may allow an attacker to execute arbitrary code with the privileges of the guacd process.

Affected products

• Apache Guacamole: from 0.9.0, before 1.5.2 (fixed in 1.5.2)

Published 2023-06-07. Last modified 2026-06-17.