CVE-2024-32458

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.5.0 FreeRDP versions prior to 2.11.6

Description The issue is related to an out-of-bounds read in the FreeRDP client. This can be exploited by a remote attacker to disclose protected information. The vulnerability is associated with the planar skip plane rle() function. Additionally, other issues such as out-of-bounds reads in zgfx decompress segment, ncrush decompress, and interleaved decompress, as well as integer overflow and underflow in certain functions, have been identified.

Recommendations For versions prior to 3.5.0, update to version 3.5.0 to resolve the issue. For versions prior to 2.11.6, update to version 2.11.6 to resolve the issue. As a temporary workaround, consider using /gfx or /rfx modes, which are enabled by default and require server-side support.