Skip to content
OpenAdvisories
Critical · 9.8 CVE-2024-32659 EUVD-2024-30450

freerdp_image_copy out of bound read

Published Apr 23, 2024 · Updated Nov 3, 2025 · Assigned by GitHub_M

Vendor: FreeRDP Product: FreeRDP Package: freerdp Package: freerdp-3 Package: freerdp2 Package: freerdp2 Package: freerdp3 Package: freerdp3 Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.

Affected products

VendorProductAffectedFixed
FreeRDP FreeRDP < 3.5.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 freerdp3 3.5.1+dfsg1-1 —
Debian 13 freerdp3 3.5.1+dfsg1-1 —
Debian 12 freerdp2 2.11.7+dfsg1-6~deb12u1 —
Debian 11 freerdp2 2.3.0+dfsg1-2+deb11u2 DLA-4053-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS freerdp3 3.5.1+dfsg1-0ubuntu1 USN-6759-1
Ubuntu 22.04 LTS freerdp2 2.6.1+dfsg1-3ubuntu2.7 USN-6752-1
Ubuntu 20.04 LTS freerdp2 2.6.1+dfsg1-0ubuntu0.20.04.2 USN-6752-1
Ubuntu 18.04 LTS freerdp No fix yet —
Ubuntu 16.04 LTS freerdp No fix yet —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 24.04 LTS freerdp2 2.11.5+dfsg1-1ubuntu0.1~esm2 USN-7371-1
Ubuntu Pro 18.04 LTS freerdp2 No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 9 freerdp +4 2:2.11.7-1.el9 RHSA-2024:9092

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 freerdp 2.4.0-150400.3.32.1 SUSE-SU-2024:2631-1, SUSE-SU-2024:1856-1
SLES 15 SP5 freerdp 2.4.0-150400.3.32.1 SUSE-SU-2024:1856-1
SLES 12 SP5 freerdp 2.1.2-12.47.1 SUSE-SU-2024:1835-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed freerdp 3.21.0-2.1 openSUSE-SU-2026:10123-1
openSUSE Tumbleweed freerdp2 2.11.5-3.1 openSUSE-SU-2024:13994-1
openSUSE Leap 16.0 freerdp 3.22.0-160000.1.1 openSUSE-SU-2026:20339-1
openSUSE Leap 15.6 freerdp 2.11.2-150600.4.3.1 SUSE-SU-2024:2631-1
openSUSE Leap 15.5 freerdp 2.4.0-150400.3.32.1 SUSE-SU-2024:1856-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 freerdp +4 2:2.11.7-1.amzn2.0.1 ALAS2-2024-2537

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 freerdp +4 2:2.11.7-1.el9 ELSA-2024-9092

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling freerdp-3 3.5.1-r0 —

Advisories 14

References