CVE-2024-32459

What it actually does

Out-of-bounds read in FreeRDP RDP protocol handling allows an attacker to read memory beyond allocated buffers in client or server components.

Why it matters to the business

Attackers can remotely extract sensitive data or crash remote desktop services, disrupting operations for organizations relying on FreeRDP for cross-platform access.

How an attack unfolds

An attacker connects to a vulnerable FreeRDP client or server and sends specially crafted RDP packets that trigger an out-of-bounds memory read during protocol parsing.

How to fix it

Upgrade to FreeRDP 3.5.0, 2.11.6 or later; apply commit dee7e7e7c609c5192273cf8c20540c729ddcb3b0 for GIT builds. No workarounds exist.

How to confirm the fix worked

Verify installed version is at least 3.5.0 or 2.11.6; recompile from the fixed commit and confirm absence of the vulnerable buffer handling code paths.

Typical attack path

1. Identify exposed FreeRDP-based RDP endpoints
2. Establish an RDP connection with a vulnerable version
3. Transmit malformed protocol data designed to exceed buffer bounds
4. Read or crash memory contents to achieve information disclosure or denial of service

How to detect it

Review RDP server and client logs for unexpected crashes or malformed packet handling; inspect network captures for unusual protocol sequences targeting FreeRDP endpoints.

What your security team should do

• Immediately update all FreeRDP deployments to patched releases
• Scan inventories for any remaining pre-3.5.0 or pre-2.11.6 instances
• Monitor network traffic for anomalous RDP connections until upgrades complete
• Prioritize patching given critical CVSS and stable EPSS score