CVE-2024-32460

What it actually does

Out-of-bounds read in the legacy GDI drawing path when handling 32-bit-per-pixel color depth in RDP clients, allowing access to memory beyond allocated buffers.

Why it matters to the business

Potential exposure of sensitive client memory contents or denial-of-service during remote desktop sessions, disrupting secure access and increasing risk for organizations relying on FreeRDP for remote connectivity.

How an attack unfolds

An attacker hosts a malicious RDP server and waits for a vulnerable client to connect using the legacy /bpp:32 GDI path. The server sends specially crafted drawing commands that trigger the out-of-bounds read, potentially leaking memory or causing a crash.

How to fix it

Upgrade FreeRDP to version 3.5.0 or 2.11.6 (commit dee7e7e7c609c5192273cf8c20540c729ddcb3b0). As a temporary mitigation, switch to modern drawing paths such as /rfx or /gfx, which require server-side support.

How to confirm the fix worked

Verify client version is 3.5.0 or newer, confirm modern drawing paths are active in connection settings, and test connections against a patched server to ensure no OOB reads occur under legacy conditions.

Typical attack path

1. Attacker configures a malicious RDP server to respond to incoming connections
2. Victim initiates a client connection using the legacy GDI drawing path with /bpp:32
3. Server transmits crafted bitmap or drawing data exceeding expected buffer boundaries
4. Client processes the data, performing an out-of-bounds memory read
5. Attacker observes crash or extracts leaked memory contents for further exploitation

How to detect it

Review RDP client logs for connections using legacy GDI paths, monitor for unexpected crashes or memory-related errors during RDP sessions, and inspect network traffic for anomalous drawing command sequences from untrusted servers.

What your security team should do

• Immediately upgrade all FreeRDP installations to the fixed versions
• Audit and disable legacy /bpp:32 GDI paths in client configurations where possible
• Monitor for any remaining legacy-mode connections and enforce modern drawing options
• Prioritize patching in environments with high remote access usage due to potential memory disclosure