Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2024-32459 EUVD-2024-30277

FreeRDP Out-Of-Bounds Read in ncrush_decompress

Published Apr 22, 2024 · Updated Nov 3, 2025 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp2 Package: freerdp2 Package: freerdp3 Ecosystem: Debian Ecosystem: Ubuntu

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP >= 3.0.0, 3.5.0, < 2.11.6 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 freerdp2 2.11.7+dfsg1-6~deb12u1 —
Debian 11 freerdp2 2.3.0+dfsg1-2+deb11u2 DLA-4053-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS freerdp3 3.5.0+dfsg1-0ubuntu1 —
Ubuntu 22.04 LTS freerdp2 2.6.1+dfsg1-3ubuntu2.6 USN-6749-1
Ubuntu 20.04 LTS freerdp2 2.6.1+dfsg1-0ubuntu0.20.04.1 USN-6749-1
Ubuntu 18.04 LTS freerdp No fix yet —
Ubuntu 16.04 LTS freerdp No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS freerdp2 2.11.5+dfsg1-1ubuntu0.1~esm2 USN-7371-1
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 freerdp +4 2:2.11.7-1.el9 RHSA-2024:9092

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 freerdp 2.4.0-150400.3.29.1 SUSE-SU-2024:1610-1
SLES 12 SP5 freerdp 2.1.2-12.44.1 SUSE-SU-2024:1609-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp 3.5.1-1.1 openSUSE-SU-2024:13900-1
openSUSE Tumbleweed freerdp2 2.11.7-1.1 openSUSE-SU-2024:14022-1
openSUSE Leap 16.0 freerdp 3.22.0-160000.1.1 openSUSE-SU-2026:20339-1
openSUSE Leap 15.5 freerdp 2.4.0-150400.3.29.1 SUSE-SU-2024:1610-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.1 ALAS2-2024-2537

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 freerdp +4 2:2.11.7-1.el9 ELSA-2024-9092

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • absholi7ly/FreeRDP-Out-of-Bounds-Read-CVE-2024-32459- ★ 4 · May 22, 2024

    The FreeRDP - Out-of-Bounds Read (CVE-2024-32459) vulnerability concerns FreeRDP, a free implementation of Remote Desktop Protocol. FreeRDP-based clients and servers using a version of FreeRDP prior …

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 12

References