CVE-2024-32041

FreeRDP is a free implementation of the Remote Desktop Protocol. FreeRDP based clients that use a version of FreeRDP prior to 3.5.0 or 2.11.6 are vulnerable to out-of-bounds read. Versions 3.5.0 and 2.11.6 patch the issue. As a workaround, deactivate `/gfx` (on by default, set `/bpp` or `/rfx` options instead.

• CWE-125
• CWE-125

• https://github.com/FreeRDP/FreeRDP/pull/10077Issue Tracking
• https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6Release Notes
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44rExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/Third Party Advisory
• https://github.com/FreeRDP/FreeRDP/pull/10077Issue Tracking
• https://github.com/FreeRDP/FreeRDP/releases/tag/2.11.6Release Notes
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.5.0Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-5r4p-mfx2-m44rExploit, Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JL476WVJSIE7SBUKVJRVA6A52V2HOLZ/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7SIS6NUNLUBOV4CPCSWKDE6T6C2W3WTR/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PX3U6YPZQ7PEJBVKSBUOLWVH7DHROHY5/Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKI4UISUXYNBPN4K6TIQKDRTIJ6CDCKJ/Third Party Advisory

Published

Apr 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-32036ImageSharp is a 2D graphics API. A data leakage flaw was fou…6.5
• CVE-2024-32037GeoNetwork is a catalog application to manage spatially refe…5.3
• CVE-2024-32038Wazuh is a free and open source platform used for threat pre…9.8
• CVE-2024-32039FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-3204A vulnerability has been found in c-blosc2 up to 2.13.2 and …9.8
• CVE-2024-32040FreeRDP is a free implementation of the Remote Desktop Proto…9.8
• CVE-2024-32042The key used to encrypt passwords stored in the database can…7.5
• CVE-2024-32044Improper access control for some Intel(R) Arc(TM) Pro Graphi…6.8
• CVE-2024-32045Mattermost versions 9.5.x <= 9.5.3, 9.6.x <= 9.6.1, 8.1.x <=…5.9
• CVE-2024-32046Mattermost versions 9.6.x <= 9.6.0, 9.5.x <= 9.5.2, 9.4.x <=…4.3
• CVE-2024-32047Hard-coded credentials for the CyberPower PowerPanel test s…9.8
• CVE-2024-32048Improper input validation in the Intel(R) Distribution of Op…6.5