CVE-2024-32459

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.5.0 FreeRDP versions prior to 2.11.6

Description The issue is related to out-of-bounds read and integer overflow in functions such as ncrush decompress(), zgfx decompress segment, clear decompress residual data, nsc rle decode, planar skip plane rle, and interleaved decompress. This can allow a remote attacker to execute arbitrary code. No known workarounds are available.

Recommendations For FreeRDP versions prior to 3.5.0, update to version 3.5.0 to resolve the issue. For FreeRDP versions prior to 2.11.6, update to version 2.11.6 to resolve the issue. As a temporary workaround, consider disabling the ncrush decompress() function until a patch is available. Restrict access to the vulnerable modules zgfx decompress segment, clear decompress residual data, nsc rle decode, planar skip plane rle, and interleaved decompress to minimize the risk of exploitation.