FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdpUpgrade libwinpr-devel | May 16, 2024 | Apr 22, 2024 |
| Debian | — | Upgrade freerdp2 | Feb 17, 2025 | Apr 22, 2024 |
| Huawei Euleros 2_0_sp8 | — | Upgrade freerdpUpgrade libwinprUpgrade freerdp-libs | Jan 21, 2025 | Apr 22, 2024 |
| Redhat_linux | — | Upgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-develNo solution existsUpgrade freerdp-libsUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade freerdp-debuginfo | Nov 13, 2024 | Apr 22, 2024 |
| Rocky_linux | — | Upgrade freerdp-libsUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-develUpgrade freerdp-debuginfo | Mar 18, 2025 | Apr 22, 2024 |
| Suse | — | Upgrade libfreerdp-server-proxy3-3Upgrade winpr2-develUpgrade freerdp-sdlUpgrade libwinpr3-3Upgrade libuwac0-0Upgrade freerdp-proxy-pluginsUpgrade libwinpr2Upgrade librdtk0-0Upgrade libfreerdp3-3Upgrade freerdp-develUpgrade freerdpUpgrade uwac0-0-develUpgrade freerdp-proxyUpgrade freerdp-serverUpgrade freerdp-waylandUpgrade libfreerdp2Upgrade winpr-devel | May 13, 2024 | Apr 22, 2024 |
| Ubuntu | — | Upgrade libfreerdp2-2t64 (Ubuntu Pro)Upgrade libfreerdp-server2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2Upgrade libfreerdp-client2-2t64 (Ubuntu Pro) | Apr 25, 2024 | Apr 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub