CVE-2024-32041

What it actually does

Out-of-bounds read in FreeRDP graphics channel processing when /gfx is enabled, allowing a client to read beyond allocated buffers during RDP session handling.

Why it matters to the business

Attackers may access sensitive memory contents from systems using vulnerable FreeRDP clients, increasing risk of data exposure or follow-on compromise in remote desktop environments.

How an attack unfolds

An attacker hosts or intercepts an RDP server that sends crafted graphics data over the /gfx channel; a vulnerable client connecting with /gfx enabled triggers the out-of-bounds read, potentially leaking memory.

How to fix it

Upgrade FreeRDP to 3.5.0, 2.11.6, or later; apply commit dee7e7e7c609c5192273cf8c20540c729ddcb3b0 where applicable. As a temporary measure, disable /gfx and use /bpp or /rfx instead.

How to confirm the fix worked

Verify installed FreeRDP version is 3.5.0 or 2.11.6 or newer; confirm /gfx is disabled in client configurations; test connections to known-good servers with graphics acceleration enabled.

Typical attack path

1. Attacker positions malicious or compromised RDP server
2. Client initiates connection with /gfx enabled (default)
3. Server sends specially crafted RDP graphics PDUs
4. Client performs out-of-bounds read during decoding
5. Attacker observes or uses leaked memory contents

How to detect it

Review client logs for RDP sessions using graphics acceleration; inspect for unusual memory access patterns or crashes during graphics decoding; correlate connection attempts to untrusted servers.

What your security team should do

• Immediately upgrade all FreeRDP installations to patched versions
• Disable /gfx in client launch parameters until upgrades complete
• Scan environments for any remaining pre-3.5.0 or pre-2.11.6 deployments
• Monitor for new FreeRDP releases and update dependency manifests