FreeRDP Vulnerability: Integer Underflow in NSC Codec
CVE-2024-32040

8.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
22 April 2024

What is CVE-2024-32040?

FreeRDP is an open-source implementation of the Remote Desktop Protocol, but versions prior to 3.5.0 and 2.11.6 contain a vulnerability related to integer underflow. This issue arises when FreeRDP clients establish connections with servers utilizing the NSC codec. The affected versions expose users to potential exploitation risks. Users are advised to update to the patched versions or avoid using the NSC codec by implementing a command line option ā€˜-nscā€™ to mitigate the risk.

Affected Version(s)

FreeRDP >= 3.0.0, 3.5.0 >= 3.0.0, 3.5.0

FreeRDP < 2.11.6 < 2.11.6

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
x_refsource_CONFIRM
https://github.com/FreeRDP/FreeRDP/pull/10077
x_refsource_MISC
https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-32040 : FreeRDP Vulnerability: Integer Underflow in NSC Codec