FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdp-libsUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade libwinprUpgrade freerdp-devel | May 16, 2024 | Apr 22, 2024 |
| Debian | — | Upgrade freerdp2 | Feb 17, 2025 | Apr 22, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdpUpgrade freerdp-libsUpgrade libwinpr | Jan 21, 2025 | Apr 22, 2024 |
| Redhat_linux | — | Upgrade freerdp-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade freerdp-libs-debuginfoNo solution exists | Nov 13, 2024 | Apr 22, 2024 |
| Rocky_linux | — | Upgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade freerdp | Mar 18, 2025 | Apr 22, 2024 |
| Suse | — | Upgrade libfreerdp-server-proxy3-3Upgrade freerdp-sdlUpgrade libwinpr2Upgrade libwinpr3-3Upgrade uwac0-0-develUpgrade winpr2-develUpgrade freerdp-proxy-pluginsUpgrade librdtk0-0Upgrade freerdpUpgrade libuwac0-0Upgrade libfreerdp2Upgrade freerdp-serverUpgrade freerdp-waylandUpgrade winpr-develUpgrade libfreerdp3-3Upgrade freerdp-develUpgrade freerdp-proxy | May 13, 2024 | Apr 22, 2024 |
| Ubuntu | — | Upgrade libfreerdp-server2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2Upgrade libfreerdp-client2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2t64 (Ubuntu Pro) | Apr 25, 2024 | Apr 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub