CVE-2024-32040

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 and have connections to servers using the `NSC` codec are vulnerable to integer underflow. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, do not use the NSC codec (e.g. use `-nsc`).

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-191

Affected software

No affected versions have been published.

Timeline

Published: Apr 22, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-320419.8FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.CVE-2024-320427.5The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passwor CVE-2024-320446.8Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated u CVE-2024-320455.9Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership w CVE-2024-320464.3Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API request CVE-2024-320479.8Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gai CVE-2024-320486.5Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthentica CVE-2024-320497.4BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials. Not CVE-2024-320516.5Insertion of sensitive information into log file issue exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a network CVE-2024-320539.8Hard-coded credentials are used by the CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. T CVE-2024-320557.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past CVE-2024-320567.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains an out of bounds write past