CVE-2024-32458

What it actually does

Out-of-bounds read in FreeRDP clients prior to 3.5.0 or 2.11.6 allowing access to adjacent memory during RDP protocol handling.

Why it matters to the business

Attackers may disclose sensitive memory contents or crash remote desktop sessions, disrupting operations that depend on FreeRDP for remote access across many environments.

How an attack unfolds

An attacker establishes an RDP session with a vulnerable FreeRDP client and supplies crafted protocol data that triggers reading beyond allocated buffers, potentially leaking information without authentication.

How to fix it

Upgrade freerdp/freerdp to the commit dee7e7e7c609c5192273cf8c20540c729ddcb3b0 (equivalent to 3.5.0 or 2.11.6). If immediate upgrade is not possible, enable the /gfx or /rfx command-line modes which require server-side support.

How to confirm the fix worked

Confirm client version is at least 3.5.0 or 2.11.6; test connectivity using /gfx or /rfx modes and verify absence of crashes or unexpected memory access under crafted input.

Typical attack path

1. Attacker initiates network connection to a system running a vulnerable FreeRDP client
2. Attacker negotiates an RDP session and sends malicious graphics or update packets
3. Client processes the malformed data leading to out-of-bounds memory read
4. Attacker observes returned data or observes denial-of-service effects

How to detect it

Monitor FreeRDP process logs and system crash reports for segmentation faults or memory access violations during active RDP sessions; inspect network traffic for unusual RDP graphics channel payloads.

What your security team should do

• Prioritize upgrade of all FreeRDP installations to the fixed commit within the next maintenance window
• Apply the /gfx or /rfx workaround on any systems that cannot be updated immediately
• Review network exposure of FreeRDP clients and restrict unnecessary inbound RDP access