CVE-2024-32039
📋 TL;DR
FreeRDP clients prior to versions 3.5.0 or 2.11.6 contain an integer overflow vulnerability that can lead to out-of-bounds writes when processing graphics data. This allows remote attackers to potentially execute arbitrary code or crash the client. Anyone using vulnerable FreeRDP-based remote desktop clients is affected.
💻 Affected Systems
- FreeRDP
- Any software using FreeRDP library
📦 What is this software?
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Freerdp by Freerdp
Freerdp by Freerdp
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with SYSTEM/root privileges leading to complete system compromise.
Likely Case
Client crash (denial of service) or limited remote code execution in user context.
If Mitigated
No impact if patched or workarounds applied; otherwise full compromise possible.
🎯 Exploit Status
Integer overflow to out-of-bounds write is a common exploitation path; no public exploit code known at advisory time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.0 or 2.11.6
Vendor Advisory: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9
Restart Required: Yes
Instructions:
1. Identify FreeRDP version. 2. Update to 3.5.0 (main branch) or 2.11.6 (stable branch). 3. Restart affected services/applications. 4. Verify update with version check.
🔧 Temporary Workarounds
Disable Graphics Acceleration
allDisable graphics acceleration features that trigger the vulnerable code path
xfreerdp /v:TARGET /bpp:32
wfreerdp.exe /v:TARGET /bpp:32
🧯 If You Can't Patch
- Restrict FreeRDP client usage to trusted internal servers only
- Implement network segmentation to isolate FreeRDP traffic
🔍 How to Verify
Check if Vulnerable:
Check FreeRDP version with 'xfreerdp --version' or 'wfreerdp --version'Check Version:
xfreerdp --version 2>/dev/null || wfreerdp --version 2>/dev/null || freerdp --version 2>/dev/nullVerify Fix Applied:
Confirm version is 3.5.0 or higher (main branch) OR 2.11.6 or higher (stable branch)📡 Detection & Monitoring
Log Indicators:
- FreeRDP client crashes
- Memory access violation errors in application logs
Network Indicators:
- RDP connections to untrusted/unusual destinations
- Abnormal RDP traffic patterns
SIEM Query:
source="*freerdp*" AND (event_type="crash" OR error="*overflow*" OR error="*out of bounds*")🔗 References
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
- https://github.com/FreeRDP/FreeRDP/pull/10077
- https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
- https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9
- https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/
