FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based based clients using `/bpp:32` legacy `GDI` drawing path with a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, use modern drawing paths (e.g. `/rfx` or `/gfx` options). The workaround requires server side support.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinprUpgrade freerdpUpgrade freerdp-libsUpgrade libwinpr-devel | May 16, 2024 | Apr 22, 2024 |
| Debian | — | Upgrade freerdp2 | Feb 17, 2025 | Apr 22, 2024 |
| Redhat_linux | — | Upgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoNo solution existsUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade freerdpUpgrade freerdp-develUpgrade libwinprUpgrade libwinpr-devel | Nov 13, 2024 | Apr 22, 2024 |
| Rocky_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-devel | Mar 18, 2025 | Apr 22, 2024 |
| Suse | — | Upgrade freerdp-waylandUpgrade librdtk0-0Upgrade libwinpr3-3Upgrade freerdp-sdlUpgrade winpr-develUpgrade libuwac0-0Upgrade uwac0-0-develUpgrade freerdpUpgrade libwinpr2Upgrade winpr2-develUpgrade freerdp-develUpgrade freerdp-proxy-pluginsUpgrade libfreerdp2Upgrade freerdp-serverUpgrade libfreerdp-server-proxy3-3Upgrade freerdp-proxyUpgrade libfreerdp3-3 | May 13, 2024 | Apr 22, 2024 |
| Ubuntu | — | Upgrade libfreerdp-server2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2Upgrade libfreerdp-client2-2t64 (Ubuntu Pro)Upgrade libfreerdp2-2t64 (Ubuntu Pro) | Apr 25, 2024 | Apr 22, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub