CVE-2024-32041

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
FreeRDPFreeRDP>= 3.0.0, 3.5.0; < 2.11.6
freerdpfreerdp< 2.11.6; >= 3.0.0, <= 3.5.0

References

Timeline

Published
Apr 22, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-320427.5The key used to encrypt passwords stored in the database can be found in the CyberPower PowerPanel application code, allowing the passworCVE-2024-320446.8Improper access control for some Intel(R) Arc(TM) Pro Graphics for Windows drivers before version 31.0.101.5319 may allow an authenticated uCVE-2024-320455.9Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <= 8.1.12 fail to enforce proper access controls for channel and team membership wCVE-2024-320464.3Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <= 9.4.4 and 8.1.x <= 8.1.11 fail to remove detailed error messages in API requestCVE-2024-320479.8Hard-coded credentials for the CyberPower PowerPanel test server can be found in the production code. This might result in an attacker gaiCVE-2024-320486.5Improper input validation in the Intel(R) Distribution of OpenVINO(TM) Model Server software before version 2024.0 may allow an unauthenticaCVE-2024-320497.4BIG-IP Next Central Manager (CM) may allow an unauthenticated, remote attacker to obtain the BIG-IP Next LTM/WAF instance credentials.  NotCVE-2024-320516.5Insertion of sensitive information into log file issue exists in RoamWiFi R10 prior to 4.8.45. If this vulnerability is exploited, a networkCVE-2024-320539.8Hard-coded credentials are used by the  CyberPower PowerPanel platform to authenticate to the database, other services, and the cloud. TCVE-2024-320557.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected applications contain an out of bounds read past CVE-2024-320567.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains an out of bounds write pastCVE-2024-320577.8A vulnerability has been identified in Simcenter Femap (All versions < V2406). The affected application contains a type confusion vulnerabil
CVE-2024-32041: Critical severity, CVSS 9.8 | Vulnix