CVE-2024-32039

What it actually does

Integer overflow during graphics channel processing in FreeRDP clients triggers an out-of-bounds write when /gfx is enabled, allowing memory corruption.

Why it matters to the business

Attackers can gain remote code execution on systems running vulnerable FreeRDP clients, risking compromise of user workstations and any data accessed via remote desktop sessions.

How an attack unfolds

An attacker hosts a malicious RDP server that sends crafted graphics data over the gfx channel. A vulnerable client connecting with gfx enabled processes the data, causing an integer overflow that results in an out-of-bounds write and potential code execution.

How to fix it

Upgrade FreeRDP to version 3.5.0 or 2.11.6. As a workaround, disable gfx by specifying /bpp:32 or /rfx in client options.

How to confirm the fix worked

Confirm the FreeRDP binary or package reports version 3.5.0 or 2.11.6. Test client connections to a controlled server with gfx enabled while monitoring for crashes or memory errors.

Typical attack path

1. Attacker deploys a rogue RDP server configured to deliver malicious gfx payloads
2. Victim launches a vulnerable FreeRDP client and initiates a connection with gfx enabled
3. Server transmits oversized or malformed graphics data during session negotiation
4. Client integer overflow occurs, leading to out-of-bounds write and attacker code execution

How to detect it

Search application and system logs for FreeRDP crashes or segmentation faults during graphics processing. Review network captures for unusual RDP session data volumes or malformed gfx channel traffic.

What your security team should do

• Prioritize upgrading all FreeRDP deployments to the fixed versions
• Apply the gfx workaround on any systems that cannot be updated immediately
• Restrict RDP client connections to trusted servers only
• Include FreeRDP version checks in regular vulnerability scanning