FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdpUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-libsUpgrade libwinpr-devel | May 16, 2024 | Apr 22, 2024 |
| Debian | — | Upgrade freerdp2 | Feb 17, 2025 | Apr 22, 2024 |
| Redhat_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr-develNo solution existsUpgrade freerdp-develUpgrade libwinprUpgrade freerdpUpgrade freerdp-libsUpgrade freerdp-libs-debuginfo | Nov 13, 2024 | Apr 22, 2024 |
| Rocky_linux | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade freerdp | Mar 18, 2025 | Apr 22, 2024 |
| Suse | — | Upgrade libwinpr2Upgrade freerdpUpgrade winpr2-develUpgrade freerdp-waylandUpgrade libuwac0-0Upgrade winpr-develUpgrade libwinpr3-3Upgrade uwac0-0-develUpgrade freerdp-sdlUpgrade librdtk0-0Upgrade libfreerdp3-3Upgrade freerdp-develUpgrade freerdp-proxyUpgrade libfreerdp-server-proxy3-3Upgrade libfreerdp2Upgrade freerdp-proxy-pluginsUpgrade freerdp-server | May 13, 2024 | Apr 22, 2024 |
| Ubuntu | — | Upgrade libfreerdp-server2-2t64 (Ubuntu Pro)Upgrade libfreerdp-client2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2Upgrade libfreerdp2-2t64 (Ubuntu Pro) | Apr 25, 2024 | Apr 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub