CVE-2024-32659

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-bounds read if `((nWidth == 0) and (nHeight == 0))`. Version 3.5.1 contains a patch for the issue. No known workarounds are available.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
FreeRDPFreeRDP< 3.5.1
freerdpfreerdp< 3.5.1

References

Timeline

Published
Apr 23, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2024

CVE-2024-32665.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the URL attribute of widgets in all versions up CVE-2024-326607.5FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.5.1, a malicious server can crash the FreeRDP client by CVE-2024-326617.5FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to a possible `CVE-2024-326629.8FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients prior to version 3.5.1 are vulnerable to out-of-boundCVE-2024-326637.5Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0CVE-2024-326647.3Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.5 and 6.0CVE-2024-326665.5NULL pointer dereference in Intel(R) RAID Web Console software for all versions may allow an authenticated user to potentially enable denialCVE-2024-326673.9Out-of-bounds read for some OpenCL(TM) software may allow an authenticated user to potentially enable denial of service via local access.CVE-2024-326688.2An insufficient boundary validation in the USB code could lead to an out-of-bounds write on the heap, with data controlled by the caller. ACVE-2024-326695.3Improper Input Validation vulnerability in Samsung Open Source escargot JavaScript engine allows Overflow Buffers. However, it occurs in theCVE-2024-32675.4The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_price_list shortcode in all vCVE-2024-326707.0Exposure of Sensitive Information to an Unauthorized Actor in Samsung Galaxy SmartTag2 prior to 0.20.04 allows attackes to potentially ident
CVE-2024-32659: Critical severity, CVSS 9.8 | Vulnix