CVE-2024-22211: FreeRDP Buffer Overflow Vulnerability

CVE-2024-22211 Overview

CVE-2024-22211 is an integer overflow vulnerability in FreeRDP, the widely-used open source remote desktop protocol library and client suite. The vulnerability exists in the freerdp_bitmap_planar_context_reset function, where an integer overflow condition leads to a heap-buffer overflow. This affects FreeRDP-based clients, while server implementations and proxies remain unaffected.

Critical Impact

A malicious RDP server can exploit this vulnerability by sending a crafted RDPGFX_RESET_GRAPHICS_PDU packet to allocate undersized buffers, potentially triggering out-of-bounds read/write operations on connected clients.

Affected Products

• FreeRDP versions prior to 2.11.5
• FreeRDP versions 3.x prior to 3.2.0
• All FreeRDP-based client implementations using vulnerable library versions

Discovery Timeline

• January 19, 2024 - CVE-2024-22211 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-22211

Vulnerability Analysis

This vulnerability combines two weakness types: CWE-190 (Integer Overflow) and CWE-122 (Heap-based Buffer Overflow). The flaw resides in the planar codec component of FreeRDP's graphics processing subsystem, specifically within libfreerdp/codec/planar.c.

The vulnerable code performs arithmetic operations on width and height values without proper overflow validation. When calculating maxPlaneSize by multiplying maxWidth and maxHeight, the result can wrap around due to integer overflow, resulting in a much smaller value than intended. This causes undersized buffer allocations that subsequent operations will overflow.

While data extraction over the network is not possible since the affected buffers are used exclusively for image display, the heap corruption could lead to code execution or denial of service conditions on the client system.

Root Cause

The root cause is insufficient validation of multiplication operations in the planar context reset function. When maxWidth * maxHeight exceeds the maximum value representable by a 32-bit unsigned integer (UINT32_MAX), the result wraps around to a small value. This small value is then used to allocate heap buffers that are far too small for the actual image data that will be written to them.

Additionally, the calculation of nTempStep (computed as maxWidth * 4) lacks overflow checking, creating another potential overflow vector when processing large width values.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. A malicious server can craft a RDPGFX_RESET_GRAPHICS_PDU packet with specially chosen width and height values that trigger the integer overflow. When a vulnerable FreeRDP client connects to this malicious server and processes the graphics reset command, the undersized buffers are allocated and subsequently overflowed during image rendering operations.

// Security patch in libfreerdp/codec/planar.c
// Source: https://github.com/FreeRDP/FreeRDP/commit/939e922936e9c3ae8fc204968645e5e7563a2fff

 	context->bgr = FALSE;
 	context->maxWidth = PLANAR_ALIGN(width, 4);
 	context->maxHeight = PLANAR_ALIGN(height, 4);
-	context->maxPlaneSize = context->maxWidth * context->maxHeight;
+	const UINT64 tmp = (UINT64)context->maxWidth * context->maxHeight;
+	if (tmp > UINT32_MAX)
+		return FALSE;
+	context->maxPlaneSize = tmp;
+
+	if (context->maxWidth > UINT32_MAX / 4)
+		return FALSE;
 	context->nTempStep = context->maxWidth * 4;

 	memset(context->planes, 0, sizeof(context->planes));

Detection Methods for CVE-2024-22211

Indicators of Compromise

• Unexpected crashes or abnormal terminations of FreeRDP client processes
• Memory corruption errors in FreeRDP client logs
• RDP connections to untrusted or unknown server endpoints
• Anomalous RDPGFX_RESET_GRAPHICS_PDU packets with unusually large dimension values

Detection Strategies

• Monitor for FreeRDP client process crashes with heap corruption signatures
• Implement network-level inspection for RDP Graphics Pipeline Extension (RDPGFX) traffic with abnormal parameters
• Use memory-safe runtime protections (ASLR, stack canaries) to detect exploitation attempts
• Deploy endpoint detection solutions to identify suspicious RDP client behavior patterns

Monitoring Recommendations

• Enable crash dump collection for FreeRDP client processes to capture exploitation evidence
• Implement logging of RDP connection destinations to identify connections to potentially malicious servers
• Monitor system memory usage anomalies during RDP sessions
• Track FreeRDP library versions across endpoints to identify vulnerable installations

How to Mitigate CVE-2024-22211

Immediate Actions Required

• Upgrade FreeRDP to version 2.11.5 or later (for 2.x branch)
• Upgrade FreeRDP to version 3.2.0 or later (for 3.x branch)
• Restrict RDP client connections to trusted servers only
• Consider temporarily disabling FreeRDP-based clients until patching is complete

Patch Information

The FreeRDP project has released security patches addressing this vulnerability. The fix involves casting multiplication operands to 64-bit integers before performing the calculation, then validating that the result fits within 32-bit bounds before use.

For more information, see the GitHub Security Advisory and the associated commits: FreeRDP Commit Update and FreeRDP Commit Fix.

Distribution-specific updates are available via Fedora Package Announcements and Debian LTS Advisory.

Workarounds

• No official workarounds are available for this vulnerability
• Implement network segmentation to limit RDP client exposure to untrusted networks
• Use application allowlisting to control which endpoints can run FreeRDP clients
• Consider using alternative RDP clients until FreeRDP can be updated

# Verify FreeRDP version to confirm patched status
xfreerdp --version

# For systems using package managers, check installed version
# Debian/Ubuntu
dpkg -l | grep freerdp

# Fedora/RHEL
rpm -qa | grep freerdp

# Ensure version is 2.11.5+ or 3.2.0+ to be protected