{"id":"CVE-2024-32040","aliases":["CLSA-2025-1739825397","DEBIAN-CVE-2024-32040","DLA-4053-1","EUVD-2024-29874","GHSA-23c5-cp23-h2h5","MGASA-2024-0157","OESA-2024-1515","RHSA-2024:9092","SUSE-SU-2024:1609-1","SUSE-SU-2024:1610-1","UBUNTU-CVE-2024-32040","USN-6749-1","USN-7341-1","openSUSE-SU-2024:13900-1","openSUSE-SU-2024:14022-1","openSUSE-SU-2026:20339-1"],"status":"published","title":"FreeRDP vulnerable to integer underflow in nsc_rle_decode","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.01907,"percentile":0.79899,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-191"],"published":"2024-04-22T20:36:45Z","modified":"2026-11-02T12:02:18Z","fixes":[{"ecosystem":"Debian:12","package":"freerdp2","fixed_in":["2.11.7+dfsg1-6~deb12u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","fixed_in":["2.6.1+dfsg1-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","fixed_in":["2.6.1+dfsg1-3ubuntu2.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.5.0+dfsg1-0ubuntu1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","fixed_in":["2.11.5+dfsg1-1ubuntu0.1~esm1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.el7_9.tuxcare.els4"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7+dfsg1-6~deb12u1"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5"]},{"source":"osv","ecosystem":"Debian:11","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0+dfsg1-2+deb11u2"}]}],"versions":["2.3.0+dfsg1-2","2.3.0+dfsg1-2+deb11u1"],"bundled":32},{"source":"osv","ecosystem":"Mageia:9","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.mga9"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.oe1"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.oe2003sp4"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.oe2203sp3"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.oe2203sp1"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.oe2203sp2"}]}],"bundled":9},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.oe2203sp3"}]}],"bundled":9},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.44.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-12.44.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 15 SP5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-150400.3.29.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-0ubuntu0.20.04.1"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.6"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.0+dfsg1-0ubuntu1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-0ubuntu0.20.04.1"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.1+dfsg1-3ubuntu2.6"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5"],"bundled":7},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.5+dfsg1-1ubuntu0.1~esm1"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.7-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.22.0-160000.1.1"}]}],"bundled":44}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5","tags":["x_refsource_CONFIRM","x_transferred","Mitigation","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/pull/10077","tags":["x_refsource_MISC","x_transferred","Issue Tracking","fix","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0","tags":["x_refsource_MISC","x_transferred","Release Notes","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html","tags":["web"]},{"url":"https://errata.tuxcare.com/centos7-els/CLSA-2025-1739825397.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32040.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32040","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-32040","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33129","tags":["report"]},{"url":"https://lwn.net/Articles/970778/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1515","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32660","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9092","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276971","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-33988","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9092.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22211","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/939e922936e9c3ae8fc204968645e5e7563a2fff","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/aeac3040cc99eeaff1e1171a822114c857b9dca9","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rjhp-44rv-7v59","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32039","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32040","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32041","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32458","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32459","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32460","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32658","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32659","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32660","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32661","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32661","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32661","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32662","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32662","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vffh-j6hh-95f4","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241609-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1223293","tags":["report"]},{"url":"https://bugzilla.suse.com/1223294","tags":["report"]},{"url":"https://bugzilla.suse.com/1223295","tags":["report"]},{"url":"https://bugzilla.suse.com/1223296","tags":["report"]},{"url":"https://bugzilla.suse.com/1223297","tags":["report"]},{"url":"https://bugzilla.suse.com/1223298","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32040","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32459","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32460","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241610-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-32040","tags":["report"]},{"url":"https://www.freerdp.com/2024/04/17/2_11_6-release","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6749-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7341-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-22211","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32039","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32458","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32459","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32460","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32661","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214869","tags":["report"]},{"url":"https://bugzilla.suse.com/1214870","tags":["report"]},{"url":"https://bugzilla.suse.com/1214871","tags":["report"]},{"url":"https://bugzilla.suse.com/1219049","tags":["report"]},{"url":"https://bugzilla.suse.com/1223346","tags":["report"]},{"url":"https://bugzilla.suse.com/1223347","tags":["report"]},{"url":"https://bugzilla.suse.com/1223348","tags":["report"]},{"url":"https://bugzilla.suse.com/1223353","tags":["report"]},{"url":"https://bugzilla.suse.com/1243109","tags":["report"]},{"url":"https://bugzilla.suse.com/1256717","tags":["report"]},{"url":"https://bugzilla.suse.com/1256718","tags":["report"]},{"url":"https://bugzilla.suse.com/1256719","tags":["report"]},{"url":"https://bugzilla.suse.com/1256720","tags":["report"]},{"url":"https://bugzilla.suse.com/1256721","tags":["report"]},{"url":"https://bugzilla.suse.com/1256722","tags":["report"]},{"url":"https://bugzilla.suse.com/1256723","tags":["report"]},{"url":"https://bugzilla.suse.com/1256724","tags":["report"]},{"url":"https://bugzilla.suse.com/1256725","tags":["report"]},{"url":"https://bugzilla.suse.com/1256940","tags":["report"]},{"url":"https://bugzilla.suse.com/1256941","tags":["report"]},{"url":"https://bugzilla.suse.com/1256942","tags":["report"]},{"url":"https://bugzilla.suse.com/1256943","tags":["report"]},{"url":"https://bugzilla.suse.com/1256944","tags":["report"]},{"url":"https://bugzilla.suse.com/1256945","tags":["report"]},{"url":"https://bugzilla.suse.com/1256946","tags":["report"]},{"url":"https://bugzilla.suse.com/1256947","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40574","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40575","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-40576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-22211","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32658","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32659","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32661","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4478","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22854","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22855","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22856","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-22859","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23530","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23532","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23533","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23534","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23732","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23883","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-23948","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24491","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24675","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24679","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24680","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24682","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24683","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-24684","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-32040","title":"FreeRDP vulnerable to integer underflow in nsc_rle_decode","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","status":"published","published":"2024-04-22T20:36:45.439Z","modified":"2025-11-03T20:37:18.123Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:34:15.662528Z"}],"euvd":[{"id":"EUVD-2024-29874","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","status":"published","published":"2024-04-22T20:36:45Z","modified":"2025-11-03T20:37:18Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:32.126029Z"}],"nvd":[{"id":"CVE-2024-32040","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","status":"published","published":"2024-04-22T21:15:49.29Z","modified":"2026-06-17T07:29:10.01Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-32040","title":"FreeRDP vulnerable to integer underflow in nsc_rle_decode","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","status":"published","published":"2024-04-22T20:36:45.439Z","modified":"2026-10-28T02:31:14.797135764Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-191"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-32040","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","status":"published","published":"2024-04-22T21:15:49.29Z","modified":"2026-11-02T12:02:18.78352899Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"OESA-2024-1515","title":"freerdp security update","description":"FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft\u0026apos;s open specifications. This package provides the client applications xfreerdp and wlfreerdp.\r\n\r\nSecurity Fix(es):\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients using a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to integer overflow and out-of-bounds write. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use `/gfx` options (e.g. deactivate with `/bpp:32` or `/rfx` as it is on by default).(CVE-2024-32039)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).(CVE-2024-32040)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.(CVE-2024-32041)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use `/gfx` or `/rfx` modes (on by default, require server side support).(CVE-2024-32458)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients and servers that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. No known workarounds are available.(CVE-2024-32459)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.(CVE-2024-32460)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. Version 3.5.1 contains a patch for the issue. No known workarounds are available.(CVE-2024-32658)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.(CVE-2024-32659)\r\n\r\nFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by sending invalid huge allocation size. Version 3.5.1 contains a patch for the issue. No known workarounds are available.(CVE-2024-32660)","status":"published","published":"2024-04-26T11:06:57Z","modified":"2026-08-18T01:18:24.808515117Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"RHSA-2024:9092","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2024-11-12T17:54:29Z","modified":"2026-06-26T12:21:21.034664276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-32040","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).","status":"published","published":"2024-04-23T00:00:00Z","modified":"2026-06-16T13:30:40.096399869Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"CLSA-2025-1739825397","title":"freerdp: Fix of 6 CVEs","description":"- CVE-2024-32458: fix missing input length checks\n- CVE-2024-32459: fix missing input length check\n- CVE-2024-32460: fix out-of-bound read in interleaved_decompress\n- CVE-2024-32039: fix integer overflow\n- CVE-2024-32040: fix missing check\n- CVE-2024-32041: fix integer overflow","status":"published","published":"2025-02-17T20:50:02Z","modified":"2026-10-21T10:47:54.44021471Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"DLA-4053-1","title":"freerdp2 - security update","status":"published","published":"2025-02-15T00:00:00Z","modified":"2026-03-09T01:19:24.57066Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2024-0157","title":"Updated freerdp packages fix security vulnerabilities","description":"This release is a security release and addresses multiple issues:\n[Low] OutOfBound Read in zgfx_decompress_segment.\n[Moderate] Integer overflow \u0026 OutOfBound Write in\nclear_decompress_residual_data.\n[Low] integer underflow in nsc_rle_decode.\n[Low] OutOfBound Read in planar_skip_plane_rle.\n[Low] OutOfBound Read in ncrush_decompress.\n[Low] OutOfBound Read in interleaved_decompress.\n","status":"published","published":"2024-04-30T22:25:14Z","modified":"2026-04-16T04:43:27.537818148Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13900-1","title":"freerdp-3.5.1-1.1 on GA media","description":"These are all security issues fixed in the freerdp-3.5.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:13:50.906886Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14022-1","title":"freerdp2-2.11.7-1.1 on GA media","description":"These are all security issues fixed in the freerdp2-2.11.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:14:41.245797Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:20339-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\nUpdate to version 3.22.0 (jsc#PED-15526):\n\n  + Major bugfix release:\n\n    * Complete overhaul of SDL client\n    * Introduction of new WINPR_ATTR_NODISCARD macro wrapping compiler or C language version specific [[nodiscard]] attributes\n    * Addition of WINPR_ATTR_NODISCARD to (some) public API functions so usage errors are producing warnings now\n    * Add some more stringify functions for logging\n    * We've received CVE reports, check\n      https://github.com/FreeRDP/FreeRDP/security/advisories for more details!\n      @Keryer reported an issue affecting client and proxy:\n      * CVE-2026-23948\n      @ehdgks0627 did some more fuzzying and found quite a number of client side bugs.\n      * CVE-2026-24682\n      * CVE-2026-24683\n      * CVE-2026-24676\n      * CVE-2026-24677\n      * CVE-2026-24678\n      * CVE-2026-24684\n      * CVE-2026-24679\n      * CVE-2026-24681\n      * CVE-2026-24675\n      * CVE-2026-24491\n      * CVE-2026-24680\n\n- Changes from version 3.21.0\n\n  * [core,info] fix missing NULL check (#12157)\n  * [gateway,tsg] fix TSG_PACKET_RESPONSE parsing (#12161)\n  * Allow querying auth identity with kerberos when running as a server (#12162)\n  * Sspi krb heimdal (#12163)\n  * Tsg fix idleTimeout parsing (#12167)\n  * [channels,smartcard] revert 649f7de (#12166)\n  * [crypto] deprecate er and der modules (#12170)\n  * [channels,rdpei] lock full update, not only parts (#12175)\n  * [winpr,platform] add WINPR_ATTR_NODISCARD macro (#12178)\n  * Wlog cleanup (#12179)\n  * new stringify functions \u0026 touch API defines (#12180)\n  * Add support for querying SECPKG_ATTR_PACKAGE_INFO to NTLM and Kerberos (#12171)\n  * [channels,video] measure times in ns (#12184)\n  * [utils] Nodiscard (#12187)\n  * Error handling fixes (#12186)\n  * [channels,drdynvc] check pointer before reset (#12189)\n  * Winpr api def (#12190)\n  * [winpr,platform] drop C23 [[nodiscard]] (#12192)\n  * [gdi] add additional checks for a valid rdpGdi (#12194)\n  * Sdl3 high dpiv2 (#12173)\n  * peer: Disconnect if Logon() returned FALSE (#12196)\n  * [channels,rdpecam] fix PROPERTY_DESCRIPTION parsing (#12197)\n  * [channel,rdpsnd] only clean up thread before free (#12199)\n  * [channels,rdpei] add RDPINPUT_CONTACT_FLAG_UP (#12195)\n\n- Update to version 3.21.0:\n\n  + Bugfix release with a few new API functions addressing shortcomings with\n    regard to input data validation.\n    Thanks to @ehdgks0627 we have fixed the following additional (medium)\n    client side vulnerabilities:\n\n    * CVE-2026-23530\n    * CVE-2026-23531\n    * CVE-2026-23532\n    * CVE-2026-23533\n    * CVE-2026-23534\n    * CVE-2026-23732\n    * CVE-2026-23883\n    * CVE-2026-23884\n\n- Changes from version 3.20.2\n\n  * [client,sdl] fix monitor resolution (#12142)\n  * [codec,progressive] fix progressive_rfx_upgrade_block (#12143)\n  * Krb cache fix (#12145)\n  * Rdpdr improved checks (#12141)\n  * Codec advanced length checks (#12146)\n  * Glyph fix length checks (#12151)\n  * Wlog printf format string checks (#12150)\n  * [warnings,format] fix format string warnings (#12152)\n  * Double free fixes (#12153)\n  * [clang-tidy] clean up code warnings (#12154)\n\n- Update to version 3.20.2:\n\n  + Patch release fixing a regression with gateway connections\n    introduced with 3.20.1\n    ## What's Changed\n    * Warnings and missing enumeration types (#12137)\n\n- Changes from version 3.20.1:\n\n  + New years cleanup release. Fixes some issues reported and does\n    a cleaning sweep to bring down warnings.\n    Thanks to @ehdgks0627 doing some code review/testing we've\n    uncovered the following (medium) vulnerabilities:\n\n    * CVE-2026-22851\n    * CVE-2026-22852\n    * CVE-2026-22853\n    * CVE-2026-22854\n    * CVE-2026-22855\n    * CVE-2026-22856\n    * CVE-2026-22857\n    * CVE-2026-22858\n    * CVE-2026-22859\n\n  + These affect FreeRDP based clients only, with the exception of\n    CVE-2026-22858 also affecting FreeRDP proxy. FreeRDP based\n    servers are not affected.\n\n- Update to version 3.20.0:\n\n  * Mingw fixes (#12070)\n  * [crypto,certificate_data] add some hostname sanitation\n  * [client,common]: Fix loading of rdpsnd channel\n  * [client,sdl] set touch and pen hints\n\n- Changes from version 3.19.1:\n\n  * [core,transport] improve SSL error logging\n  * [utils,helpers] fix freerdp_settings_get_legacy_config_path\n  * From stdin and sdl-creds improve\n  * [crypto,certificate] sanitize hostnames\n  * [channels,drdynvc] propagate error in dynamic channel\n  * [CMake] make Mbed-TLS and LibreSSL experimental\n  * Json fix\n  * rdpecam: send sample only if it's available\n  * [channels,rdpecam] allow MJPEG frame skip and direct passthrough\n  * [winpr,utils] explicit NULL checks in jansson WINPR_JSON_ParseWithLength\n\n- Changes from version 3.19.0:\n\n  * [client,common] fix retry counter\n  * [cmake] fix aarch64 neon detection\n  * Fix response body existence check when using RDP Gateway\n  * fix line clipping issue\n  * Clip coord fix\n  * [core,input] Add debug log to keyboard state sync\n  * Update command line usage for gateway option\n  * [codec,ffmpeg] 8.0 dropped AV_PROFILE_AAC_MAIN\n  * [channels,audin] fix pulse memory leak\n  * [channels,drive] Small performance improvements in drive channel\n  * [winpr,utils] fix command line error logging\n  * [common,test] Adjust AVC and H264 expectations\n  * drdynvc: implement compressed packet\n  * [channels,rdpecam] improve log messages\n  * Fix remote credential guard channel loading\n  * Fix inverted ifdef\n  * [core,nego] disable all enabled modes except the one requested\n  * rdpear: handle basic NTLM commands and fix server-side\n  * [smartcardlogon] Fix off-by-one error in `smartcard_hw_enumerateCerts`\n  * rdpecam: fix camera sample grabbing\n\n- Update to version 3.18.0:\n\n  + Fix a regression reading passwords from stdin\n  + Fix a timer regression (µs instead of ms)\n  + Improved multitouch support\n  + Fix a bug with PLANAR codec (used with /bpp:32 or sometimes with /gfx)\n  + Better error handling for ARM transport (Entra)\n  + Fix audio encoder lag (microphone/AAC) with FFMPEG\n  + Support for janssen JSON library\n\n- Update to version 3.17.2:\n\n  + Minor improvements and bugfix release.\n  + Most notably resource usage (file handles) has been greatly reduced and\n    static build pkg-config have been fixed.\n    For users of xfreerdp RAILS/RemoteApp mode the switch to DesktopSession\n    mode has been fixed (working UAC screen)\n\n- Changes from version 3.17.1\n\n  + Minor improvements and bugfix release.\n    * most notably a memory leak was addressed\n    * fixed header files missing C++ guards\n    * xfreerdp as well as the SDL clients now support a system wide configuration file\n    * Heimdal kerberos support was improved\n    * builds with [MS-RDPEAR] now properly abort at configure if Heimdal is used\n      (this configuration was never supported, so ensure nobody compiles it that way)\n\n- Enable openh264 support, we can build against the noopenh264 stub\n\n- Update to 3.17.0:\n\n  * [client,sdl2] fix build with webview (#11685)\n  * [core,nla] use wcslen for password length (#11687)\n  * Clear channel error prior to call channel init event proc (#11688)\n  * Warn args (#11689)\n  * [client,common] fix -mouse-motion (#11690)\n  * [core,proxy] fix IPv4 and IPv6 length (#11692)\n  * Regression fix2 (#11696)\n  * Log fixes (#11693)\n  * [common,settings] fix int casts (#11699)\n  * [core,connection] fix log level of several messages (#11697)\n  * [client,sdl] print current video driver (#11701)\n  * [crypto,tls] print big warning for /cert:ignore (#11704)\n  * [client,desktop] fix StartupWMClass setting (#11708)\n  * [cmake] unify version creation (#11711)\n  * [common,settings] force reallocation on caps copy (#11715)\n  * [manpages] Add example of keyboard remapping (#11718)\n  * Some fixes in Negotiate and NLA (#11722)\n  * [client,x11] fix clipboard issues (#11724)\n  * kerberos: do various tries for TGT retrieval in u2u (#11723)\n  * Cmdline escape strings (#11735)\n  * [winpr,utils] do not log command line arguments (#11736)\n  * [api,doc] Add stylesheed for doxygen (#11738)\n  * [core,proxy] fix BIO read methods (#11739)\n  * [client,common] fix sso_mib_get_access_token return value in error case (#11741)\n  * [crypto,tls] do not use context-\u003esettings-\u003einstance (#11749)\n  * winpr: re-introduce the credentials module (#11734)\n  * [winpr,timezone] ensure thread-safe initialization (#11754)\n  * core/redirection: Ensure stream has enough space for the certificate (#11762)\n  * [client,common] do not log success (#11766)\n  * Clean up bugs exposed on systems with high core counts (#11761)\n  * [cmake] add installWithRPATH (#11747)\n  * [clang-tidy] fix various warnings (#11769)\n  * Wlog improve type checks (#11774)\n  * [client,common] fix tenantid command line parsing (#11779)\n  * Proxy module static and shared linking support (#11768)\n  * LoadLibrary Null fix (#11786)\n  * [client,common] add freerdp_client_populate_settings_from_rdp_file_un… (#11780)\n  * Fullchain support (#11787)\n  * [client,x11] ignore floatbar events (#11771)\n  * [winpr,credentials] prefer utf-8 over utf-16-LE #11790\n  * [proxy,modules] ignore bitmap-filter skip remaining #11789\n\n- Update to 3.16.0:\n  * Lots of improvements for the SDL3 client\n  * Various X11 client improvements\n  * Add a timer implementation\n  * Various AAD/Azure/Entra improvements\n  * YUV420 primitives fixes\n- Update to 3.15.0:\n  * [client,sdl] fix crash on suppress output\n  * [channels,remdesk] fix possible memory leak\n  * [client,x11] map exit code success\n  * Hidef rail checks and deprecation fixe\n  * Standard rdp security network issues\n  * [core,rdp] fix check for SEC_FLAGSHI_VALID\n  * [core,caps] fix rdp_apply_order_capability_set\n  * [core,proxy] align no_proxy to curl\n  * [core,gateway] fix string reading for TSG\n  * [client,sdl] refactor display update\n\n- Update to version 3.14.0:\n\n  + Bugfix and cleanup release. Due to some new API functions the\n    minor version has been increased.\n\n- Changes from version 3.13.0:\n\n  + Friends of old hardware rejoice, serial port redirection got an\n    update (not kidding you)\n  + Android builds have been updated to be usable again\n  + Mingw builds now periodically do a shared and static build\n  + Fixed some bugs and regressions along the way and improved test\n    coverage as well\n\n- Changes from version 3.12.0:\n\n  + Multimonitor backward compatibility fixes\n  + Smartcard compatibility\n  + Improve the [MS-RDPECAM] support\n  + Improve smartcard redirection support\n  + Refactor SSE optimizations: Split headers, unify load/store,\n    require SSE3 for all optimized functions\n  + Refactors the CMake build to better support configuration based\n    builders\n  + Fix a few regressions from last release (USB redirection and\n    graphical glitches)\n\n- Changes from version 3.11.0:\n\n  + A new release with bugfixes and code cleanups as well as a few\n    nifty little features\n\n- CVE-2024-22211: In affected versions an integer overflow in\n    `freerdp_bitmap_planar_context_reset` leads to heap-buffer\n    overflow. (bsc#1219049)\n\n- CVE-2024-32658: Fixedout-of-bounds read in Interleaved RLE Bitmap Codec in FreeRDP based clients (bsc#1223353)\n\n- Multiple CVE fixes\n  + CVE-2024-32659: Fixed out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`(bsc#1223346)\n  + CVE-2024-32660: Fixed client crash via invalid huge allocation size (bsc#1223347)\n  + CVE-2024-32661: Fixed client NULL pointer dereference (bsc#1223348)\n\n- Multiple CVE fixes:\n    * bsc#1223293, CVE-2024-32039\n    * bsc#1223294, CVE-2024-32040\n    * bsc#1223295, CVE-2024-32041\n    * bsc#1223296, CVE-2024-32458\n    * bsc#1223297, CVE-2024-32459\n    * bsc#1223298, CVE-2024-32460\n\n  * Fix CVE-2023-40574 - bsc#1214869: Out-Of-Bounds Write in general_YUV444ToRGB_8u_P3AC4R_BGRX\n  * Fix CVE-2023-40575 - bsc#1214870: Out-Of-Bounds Read in general_YUV444ToRGB_8u_P3AC4R_BGRX\n  * Fix CVE-2023-40576 - bsc#1214871: Out-Of-Bounds Read in RleDecompress\n","status":"published","published":"2026-03-10T12:34:56Z","modified":"2026-03-23T04:54:51.488216Z","updated_at":"2026-11-02T16:58:41.463445Z"},{"id":"SUSE-SU-2024:1609-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2024-32039: Fixed an out-of-bounds write with variables of type uint32 (bsc#1223293)\n- CVE-2024-32040: Fixed a integer underflow when using the 'NSC' codec (bsc#1223294)\n- CVE-2024-32041: Fixed an out-of-bounds read in Stream_GetRemainingLength() (bsc#1223295)\n- CVE-2024-32458: Fixed an out-of-bounds read on pSrcData[] (bsc#1223296)\n- CVE-2024-32459: Fixed an out-of-bounds read in case SrcSize less than 4 (bsc#1223297)\n- CVE-2024-32460: Fixed an out-of-bounds read when using '/bpp:32' legacy 'GDI' drawing path (bsc#1223298)\n","status":"published","published":"2024-05-10T16:36:06Z","modified":"2026-02-04T03:53:34.065206Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1610-1","title":"Security update for freerdp","description":"This update for freerdp fixes the following issues:\n\n- CVE-2024-32039: Fixed an out-of-bounds write with variables of type uint32 (bsc#1223293)\n- CVE-2024-32040: Fixed a integer underflow when using the 'NSC' codec (bsc#1223294)\n- CVE-2024-32041: Fixed an out-of-bounds read in Stream_GetRemainingLength() (bsc#1223295)\n- CVE-2024-32458: Fixed an out-of-bounds read on pSrcData[] (bsc#1223296)\n- CVE-2024-32459: Fixed an out-of-bounds read in case SrcSize less than 4 (bsc#1223297)\n- CVE-2024-32460: Fixed an out-of-bounds read when using '/bpp:32' legacy 'GDI' drawing path (bsc#1223298)\n","status":"published","published":"2024-05-10T16:36:16Z","modified":"2026-02-04T03:55:37.50757Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-6749-1","title":"freerdp2 vulnerabilities","description":"It was discovered that FreeRDP incorrectly handled certain context resets.\nIf a user were tricked into connecting to a malicious server, a remote\nattacker could use this issue to cause FreeRDP to crash, resulting in a\ndenial of service, or possibly execute arbitrary code. (CVE-2024-22211)\n\nEvgeny Legerov discovered that FreeRDP incorrectly handled certain memory\noperations. If a user were tricked into connecting to a malicious server, a\nremote attacker could use this issue to cause FreeRDP to crash, resulting\nin a denial of service, or possibly execute arbitrary code.\n(CVE-2024-32039, CVE-2024-32040)\n\nEvgeny Legerov discovered that FreeRDP incorrectly handled certain memory\noperations. If a user were tricked into connecting to a malicious server, a\nremote attacker could possibly use this issue to cause FreeRDP to crash,\nresulting in a denial of service. (CVE-2024-32041, CVE-2024-32458,\nCVE-2024-32460)\n\nEvgeny Legerov discovered that FreeRDP incorrectly handled certain memory\noperations. A remote attacker could possibly use this issue to cause\nFreeRDP clients and servers to crash, resulting in a denial of service.\n(CVE-2024-32459)\n","status":"published","published":"2024-04-24T17:25:53Z","modified":"2026-04-27T17:12:17.633846Z","updated_at":"2026-11-02T16:58:17.914523Z"},{"id":"USN-7341-1","title":"freerdp2 vulnerabilities","description":"Evgeny Legerov discovered that FreeRDP incorrectly handled certain memory\noperations. If a user were tricked into connecting to a malicious server, a\nremote attacker could use this issue to cause FreeRDP to crash, resulting\nin a denial of service, or possibly execute arbitrary code.\n(CVE-2024-32039, CVE-2024-32040, CVE-2024-32041)\n\nEvgeny Legerov discovered that FreeRDP incorrectly handled certain memory\noperations. If a user were tricked into connecting to a malicious server, a\nremote attacker could possibly use this issue to cause FreeRDP to crash,\nresulting in a denial of service. (CVE-2024-32458, CVE-2024-32460)\n\nIt was discovered that FreeRDP incorrectly handled certain memory\noperations. If a user were tricked into connecting to a malicious server, a\nremote attacker could possibly use this issue to cause FreeRDP to crash,\nresulting in a denial of service. (CVE-2024-32661)\n","status":"published","published":"2025-03-11T13:19:21Z","modified":"2026-04-27T17:49:08.131891Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}