CVE-2024-32040

What it actually does

Integer underflow in NSC codec processing allows out-of-bounds memory access in FreeRDP clients prior to 3.5.0 or 2.11.6 when connecting to servers advertising the NSC codec.

Why it matters to the business

Successful exploitation can result in remote code execution or denial of service against systems using FreeRDP for remote access, potentially exposing sensitive data or disrupting operations that rely on RDP connectivity.

How an attack unfolds

An attacker hosts a malicious RDP server configured to offer the NSC codec; a vulnerable client initiates a connection, triggering the integer underflow during codec negotiation and data handling, which can be leveraged for memory corruption and arbitrary code execution.

How to fix it

Upgrade FreeRDP to version 3.5.0 or 2.11.6 (commit dee7e7e7c609c5192273cf8c20540c729ddcb3b0 or later); as a temporary mitigation disable the NSC codec with the -nsc flag or equivalent configuration.

How to confirm the fix worked

Verify installed FreeRDP version is 3.5.0 or newer; test client connections to non-NSC servers and confirm absence of crashes or unexpected behavior during codec negotiation.

Typical attack path

1. Attacker deploys a rogue RDP server advertising NSC codec support
2. Victim client connects using a vulnerable FreeRDP version
3. Server sends crafted NSC-encoded data triggering the underflow
4. Memory corruption occurs enabling payload execution or crash

How to detect it

Review client logs for NSC codec negotiation failures or crashes in freerdp processes; inspect network traffic for unexpected RDP sessions offering NSC; correlate process crashes with RDP connection attempts.

What your security team should do

• Immediately upgrade all FreeRDP installations to the fixed versions
• Audit configurations to ensure NSC codec is disabled where upgrades are delayed
• Monitor for new FreeRDP releases and integrate version checks into patch management