Skip to content
OpenAdvisories
Critical USN-6749-1 7 CVEs

freerdp2 vulnerabilities

Published Apr 24, 2024 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that FreeRDP incorrectly handled certain context resets.
If a user were tricked into connecting to a malicious server, a remote
attacker could use this issue to cause FreeRDP to crash, resulting in a
denial of service, or possibly execute arbitrary code. (CVE-2024-22211)

Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory
operations. If a user were tricked into connecting to a malicious server, a
remote attacker could use this issue to cause FreeRDP to crash, resulting
in a denial of service, or possibly execute arbitrary code.
(CVE-2024-32039, CVE-2024-32040)

Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory
operations. If a user were tricked into connecting to a malicious server, a
remote attacker could possibly use this issue to cause FreeRDP to crash,
resulting in a denial of service. (CVE-2024-32041, CVE-2024-32458,
CVE-2024-32460)

Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory
operations. A remote attacker could possibly use this issue to cause
FreeRDP clients and servers to crash, resulting in a denial of service.
(CVE-2024-32459)

Fixed packages 2

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS freerdp2 2.6.1+dfsg1-0ubuntu0.20.04.1
Ubuntu · 22.04 LTS 22.04:LTS freerdp2 2.6.1+dfsg1-3ubuntu2.6

Vulnerabilities 7

  • Critical 9.8
    CVE-2024-32039

    FreeRDP Integer overflow & OutOfBound Write in clear_decompress_residual_data

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.8
    CVE-2024-32041

    FreeRDP OutOfBound Read in zgfx_decompress_segment

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.8
    CVE-2024-32458

    FreeRDP Out-Of-Bounds Read in planar_skip_plane_rle

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Critical 9.8
    CVE-2024-32459 Public exploit

    FreeRDP Out-Of-Bounds Read in ncrush_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.1
    CVE-2024-32040

    FreeRDP vulnerable to integer underflow in nsc_rle_decode

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 …

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • High 8.1
    CVE-2024-32460

    FreeRDP Out-Of-Bounds Read in interleaved_decompress

    FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu
  • Low 3.7
    CVE-2024-22211

    FreeRDP integer Overflow leading to Heap Overflow

    FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_bitmap_planar_context_reset` leads to heap-buffer overflow. This affects FreeRDP based clients. FreeRDP based server imp…

    FreeRDP FreeRDP freerdp2 freerdp2 Debian Ubuntu Alpine Wolfi

References

  • report
    https://ubuntu.com/security/CVE-2024-22211
  • report
    https://ubuntu.com/security/CVE-2024-32039
  • report
    https://ubuntu.com/security/CVE-2024-32040
  • report
    https://ubuntu.com/security/CVE-2024-32041
  • report
    https://ubuntu.com/security/CVE-2024-32458
  • report
    https://ubuntu.com/security/CVE-2024-32459
  • report
    https://ubuntu.com/security/CVE-2024-32460