CVE-2024-32459

FreeRDP Out-Of-Bounds Read in ncrush_decompress

Published Apr 22, 2024 CVSS 3.1 · 9.8 Critical EPSS 3.7% KEV · Not listed
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-4053-1 freerdp2 security update
EUVD EUVD EUVD-2024-30277 FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.
Ubuntu USN Ubuntu USN USN-6749-1 FreeRDP vulnerabilities
Ubuntu USN Ubuntu USN USN-7371-1 FreeRDP vulnerabilities
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Type Values Removed Values Added
First Time appeared Fedoraproject
Fedoraproject fedora
Freerdp
Freerdp freerdp
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:39:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:*
Vendors & Products Fedoraproject
Fedoraproject fedora
Freerdp
Freerdp freerdp
Type Values Removed Values Added
First Time appeared Redhat
Redhat enterprise Linux
CPEs cpe:/a:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Weaknesses

Sources

Status
PUBLISHED
Assigner
GitHub_M
Published
Updated
Nov 3, 2025, 8:37 PM
Reserved
Apr 12, 2024, 7:41 PM
Status
Modified
Published
Apr 22, 2024, 10:15 PM
Modified
Jun 17, 2026, 7:29 AM
Severity
Low
Public date
Apr 22, 2024, 12:00 AM