CVE-2024-32040

Published: Apr 22, 2024Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).

Affected (5)

Products: Freerdp: Freerdp · Fedoraproject: Fedora

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Freerdp Freerdp	Before 2.11.6
Freerdp Freerdp	From 3.0.0 to 3.5.0

Configuration B

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 38
Fedoraproject Fedora	Version 39
Fedoraproject Fedora	Version 40

Related CWEs

Integer Underflow (Wrap or Wraparound)

The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

References (17)

https://github.com/FreeRDP/FreeRDP/pull/10077

Source: security-advisories@github.com

Issue Tracking

https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6

Source: security-advisories@github.com

Release Notes

https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0

Source: security-advisories@github.com

Release Notes

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5

Source: security-advisories@github.com

MitigationVendor Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/

Source: security-advisories@github.com

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/

Source: security-advisories@github.com

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/

Source: security-advisories@github.com

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/

Source: security-advisories@github.com

Third Party Advisory

https://github.com/FreeRDP/FreeRDP/pull/10077

Source: af854a3a-2127-422b-91ae-364da2661108

Issue Tracking

https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0

Source: af854a3a-2127-422b-91ae-364da2661108

Release Notes

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23c5-cp23-h2h5

Source: af854a3a-2127-422b-91ae-364da2661108

MitigationVendor Advisory

https://lists.debian.org/debian-lts-announce/2025/02/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.