{"id":"CVE-2024-32662","aliases":["DEBIAN-CVE-2024-32662","EUVD-2024-30453","GHSA-vffh-j6hh-95f4","RHSA-2024:9092","UBUNTU-CVE-2024-32662","USN-6759-1"],"status":"published","title":"FreeRDP rdp_redirection_read_base64_wchar out of bound read","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00769,"percentile":0.55926,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-04-23T20:17:30Z","modified":"2026-11-02T12:02:07Z","fixes":[{"ecosystem":"Debian:13","package":"freerdp3","fixed_in":["3.5.1+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.5.1+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.5.1+dfsg1-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"freerdp-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::crb","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.11.7-1.el9"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg1-0ubuntu1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5.1+dfsg1-0ubuntu1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1"],"bundled":5}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vffh-j6hh-95f4","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/626d10a94a88565d957ddc30768ed08b320049a7","tags":["x_refsource_MISC","x_transferred","Patch","fix"]},{"url":"https://oss-fuzz.com/testcase-detail/4985227207311360","tags":["x_refsource_MISC","x_transferred","Permissions Required","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32662.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32662","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-32662","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:9092","tags":["advisory"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index","tags":["article"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259483","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276721","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276722","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276723","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276724","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276726","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276804","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276961","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276970","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2276971","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-33988","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9092.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22211","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22211","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22211","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/939e922936e9c3ae8fc204968645e5e7563a2fff","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/commit/aeac3040cc99eeaff1e1171a822114c857b9dca9","tags":["article"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-rjhp-44rv-7v59","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32039","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32039","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32039","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-q5h8-7j42-j4r9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32040","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32040","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32040","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32041","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32041","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32041","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44r","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32458","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32458","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32458","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vvr6-h646-mp4p","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32459","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32459","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32459","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-cp4q-p737-rmw9","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32460","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32460","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32460","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4rr8-gr65-vqrr","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32658","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32658","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32658","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-vpv3-m3m9-4c2v","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32659","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32659","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32659","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8jgr-7r33-x87w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32660","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32660","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32660","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-mxv6-2cw6-m3mx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32661","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32661","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32661","tags":["advisory"]},{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-p5m5-342g-pv9m","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-32662","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-32662","tags":["advisory","report"]},{"url":"https://ubuntu.com/security/CVE-2024-32662","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6759-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-32658","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32659","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32660","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-32661","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-32662","title":"FreeRDP rdp_redirection_read_base64_wchar out of bound read","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","status":"published","published":"2024-04-23T20:17:30.949Z","modified":"2025-02-13T17:52:17.136Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:16.007021Z"}],"euvd":[{"id":"EUVD-2024-30453","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","status":"published","published":"2024-04-23T20:17:30Z","modified":"2025-02-13T17:52:17Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T20:53:31.829035Z"}],"nvd":[{"id":"CVE-2024-32662","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","status":"published","published":"2024-04-23T21:15:48.2Z","modified":"2026-06-17T07:30:10.92Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:09:53.50104Z"}],"osv":[{"id":"CVE-2024-32662","title":"FreeRDP rdp_redirection_read_base64_wchar out of bound read","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","status":"published","published":"2024-04-23T20:17:30.949Z","modified":"2026-10-28T10:43:57.165663732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"DEBIAN-CVE-2024-32662","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","status":"published","published":"2024-04-23T21:15:48.2Z","modified":"2026-11-02T12:02:07.920304908Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"RHSA-2024:9092","title":"Red Hat Security Advisory: freerdp security update","status":"published","published":"2024-11-12T17:54:29Z","modified":"2026-06-26T12:21:21.034664276Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:14.610978Z"},{"id":"UBUNTU-CVE-2024-32662","description":"FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read. This occurs when `WCHAR` string is read with twice the size it has and converted to `UTF-8`, `base64` decoded. The string is only used to compare against the redirection server certificate. Version 3.5.1 contains a patch for the issue. No known workarounds are available.","status":"published","published":"2024-04-23T21:15:00Z","modified":"2026-04-22T14:49:23.812533Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"USN-6759-1","title":"freerdp3 vulnerabilities","description":"It was discovered that FreeRDP incorrectly handled certain memory\noperations. If a user were tricked into connecting to a malicious server, a\nremote attacker could possibly use this issue to cause FreeRDP to crash,\nresulting in a denial of service.\n","status":"published","published":"2024-04-29T16:44:07Z","modified":"2026-04-27T17:17:26.099117332Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}