CVE-2024-32658: FreeRDP Buffer Overflow Vulnerability

CVE-2024-32658 Overview

CVE-2024-32658 is an out-of-bounds read vulnerability affecting FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). FreeRDP-based clients prior to version 3.5.1 are vulnerable to this memory safety issue, which could allow attackers to read data beyond allocated buffer boundaries. The vulnerability was identified through OSS-Fuzz testing and has been patched in version 3.5.1.

Critical Impact

This out-of-bounds read vulnerability in FreeRDP clients can be exploited remotely over the network without authentication, potentially leading to information disclosure, memory corruption, or denial of service conditions affecting RDP client systems.

Affected Products

• FreeRDP versions prior to 3.5.1
• Fedora 38, 39, and 40 (packages containing vulnerable FreeRDP versions)
• Debian LTS distributions with affected FreeRDP packages

Discovery Timeline

• April 23, 2024 - CVE-2024-32658 published to NVD
• November 3, 2025 - Last updated in NVD database

Technical Details for CVE-2024-32658

Vulnerability Analysis

The vulnerability exists in FreeRDP's interleaved codec processing, specifically in the libfreerdp/codec/interleaved.c file. The issue involves an incorrect offset calculation in the buffer_within_range bounds checking function. When processing RDP bitmap data, the code failed to properly validate buffer boundaries, allowing read operations to access memory beyond the allocated buffer.

The root cause is a boundary condition error in run-length decoding logic. When the runLength value extracted from pbOrderHdr equals zero, the code needs to read an additional byte to determine the actual run length. The original implementation only checked for 1 byte of available buffer space, but the operation actually requires 2 bytes to safely complete the read.

Root Cause

The vulnerability stems from CWE-125 (Out-of-Bounds Read). The interleaved codec's decompression routine incorrectly validated buffer boundaries when processing RDP graphics data. The off-by-one error in the bounds check allowed the code to read one byte beyond the valid buffer range, potentially accessing uninitialized or adjacent memory regions.

Attack Vector

This vulnerability can be exploited remotely over a network connection. An attacker could craft malicious RDP server responses containing specially crafted bitmap data that triggers the out-of-bounds read condition. When a vulnerable FreeRDP client connects to a malicious or compromised RDP server, the server can send manipulated graphics data that exploits this boundary check error.

The attack requires no authentication and no user interaction beyond initiating an RDP connection. This makes it particularly dangerous in scenarios where users connect to untrusted RDP servers or where an attacker can perform man-in-the-middle attacks on RDP connections.

 	runLength = (*pbOrderHdr) & g_MaskRegularRunLength;
 	if (runLength == 0)
 	{
-		if (!buffer_within_range(pbOrderHdr, 1, pbEnd))
+		if (!buffer_within_range(pbOrderHdr, 2, pbEnd))
 		{
 			*advance = 0;
 			return 0;

Source: FreeRDP Security Patch

Detection Methods for CVE-2024-32658

Indicators of Compromise

• Abnormal RDP client crashes or unexpected termination during graphics rendering
• Memory access violations or segmentation faults in FreeRDP client processes
• Unusual network traffic patterns from RDP servers containing malformed bitmap data
• Core dumps or crash logs referencing libfreerdp/codec/interleaved.c or interleaved codec functions

Detection Strategies

• Monitor FreeRDP client processes for abnormal memory access patterns or crash conditions
• Implement network intrusion detection rules to identify malformed RDP graphics responses
• Deploy endpoint detection solutions to monitor for exploitation attempts against RDP clients
• Enable application crash monitoring and analysis for FreeRDP-based applications

Monitoring Recommendations

• Enable verbose logging on FreeRDP clients to capture connection anomalies
• Monitor system logs for segmentation faults or memory violations in RDP client processes
• Track outbound RDP connections to unknown or suspicious server addresses
• Implement network-level monitoring for RDP protocol anomalies

How to Mitigate CVE-2024-32658

Immediate Actions Required

• Upgrade FreeRDP to version 3.5.1 or later immediately
• Review and restrict RDP client connections to trusted servers only
• Apply vendor-provided security updates for Fedora 38, 39, and 40 systems
• Update Debian LTS systems with the latest FreeRDP security patches

Patch Information

The vulnerability has been addressed in FreeRDP version 3.5.1. The fix corrects the boundary check in libfreerdp/codec/interleaved.c by changing the buffer range validation from 1 byte to 2 bytes, ensuring sufficient buffer space is available before reading the extended run length value.

Patches are available through:

• FreeRDP GitHub Security Advisory
• FreeRDP Commit 1a755d8
• Fedora package updates via official repositories
• Debian LTS security updates

Workarounds

• No official workarounds are available for this vulnerability
• Limit RDP client usage to connections with known, trusted servers
• Consider network segmentation to reduce exposure of RDP client systems
• Implement strict firewall rules to control RDP client outbound connections

# Verify FreeRDP version and update
freerdp --version
# Update on Fedora
sudo dnf update freerdp
# Update on Debian/Ubuntu
sudo apt update && sudo apt upgrade freerdp2-x11 libfreerdp2-2