PT-2024-3010 · Freerdp+9 · Freerdp+9
Evgeny Legerov
·
Published
2024-04-18
·
Updated
2026-03-10
·
CVE-2024-32039
CVSS v3.1
10
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 2.11.6
FreeRDP versions prior to 3.5.0
Description
The issue is related to an integer overflow and out-of-bounds write in FreeRDP, a free implementation of the Remote Desktop Protocol. This can potentially allow a remote attacker to execute arbitrary code. As a workaround, it is recommended not to use
/gfx options, which can be deactivated with /bpp:32 or /rfx as it is on by default.Recommendations
For versions prior to 2.11.6, update to version 2.11.6 to resolve the issue.
For versions prior to 3.5.0, update to version 3.5.0 to resolve the issue.
As a temporary workaround, consider deactivating the
/gfx options by using /bpp:32 or /rfx until a patch is applied.Exploit
Fix
Integer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Freerdp
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu