PT-2024-3037 · Freerdp+9 · Freerdp+9
Evgeny Legerov
·
Published
2024-04-18
·
Updated
2026-03-10
·
CVE-2024-32458
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.5.0
FreeRDP versions prior to 2.11.6
Description
The issue is related to an out-of-bounds read in the FreeRDP client. This can be exploited by a remote attacker to disclose protected information. The vulnerability is associated with the
planar skip plane rle() function. Additionally, other issues such as out-of-bounds reads in zgfx decompress segment, ncrush decompress, and interleaved decompress, as well as integer overflow and underflow in certain functions, have been identified.Recommendations
For versions prior to 3.5.0, update to version 3.5.0 to resolve the issue.
For versions prior to 2.11.6, update to version 2.11.6 to resolve the issue.
As a temporary workaround, consider using
/gfx or /rfx modes, which are enabled by default and require server-side support.Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Debian
Freerdp
Linuxmint
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu