FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdp-libsUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdpUpgrade freerdp-develUpgrade libwinpr | May 16, 2024 | Apr 22, 2024 |
| Debian | — | Upgrade freerdp2 | Feb 17, 2025 | Apr 22, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdpUpgrade libwinprUpgrade freerdp-libs | Jan 21, 2025 | Apr 22, 2024 |
| Redhat_linux | — | Upgrade freerdp-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade libwinprNo solution existsUpgrade freerdp-libs-debuginfo | Nov 13, 2024 | Apr 22, 2024 |
| Rocky_linux | — | Upgrade libwinprUpgrade freerdpUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-libs-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-debuginfo | Mar 18, 2025 | Apr 22, 2024 |
| Suse | — | Upgrade winpr-develUpgrade freerdp-waylandUpgrade libfreerdp2Upgrade freerdp-serverUpgrade freerdp-develUpgrade libfreerdp3-3Upgrade freerdp-proxyUpgrade winpr2-develUpgrade libfreerdp-server-proxy3-3Upgrade freerdpUpgrade libwinpr3-3Upgrade freerdp-proxy-pluginsUpgrade libuwac0-0Upgrade librdtk0-0Upgrade uwac0-0-develUpgrade freerdp-sdlUpgrade libwinpr2 | May 13, 2024 | Apr 22, 2024 |
| Ubuntu | — | Upgrade libfreerdp2-2t64 (Ubuntu Pro)Upgrade libfreerdp-client2-2t64 (Ubuntu Pro)Upgrade libfreerdp-server2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2 | Apr 25, 2024 | Apr 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub