CVE-2024-32459CWE-125

FreeRDP Out-Of-Bounds Read in ncrush_decompress

Critical · published April 22, 2024

CVSS v3.1
9.8
EPSS
4%
Percentile
89.7
In the wild
Unconfirmed
What it is

🚨 An out-of-bounds read vulnerability in FreeRDP could expose sensitive data like a surprise package left outside your door! 🔥 Think of FreeRDP as a postal service, delivering your sensitive data right to your computer. When there's an out-of-bounds read, it’s like the delivery person accidentally opening your package and reading the contents before it gets to you—yikes! This vulnerability allows attackers to read arbitrary memory contents, potentially leaking sensitive information without any authentication required. This could lead to a loss of confidentiality, exposing your private data to prying eyes! An attacker could gain access to crucial information stored in memory, making this a critical threat.

Put simply

Think of FreeRDP as a postal service, delivering your sensitive data right to your computer. When there's an out-of-bounds read, it’s like the delivery person accidentally opening your package and reading the contents before it gets to you—yikes! FreeRDP clients and servers prior to version 3.5.0 and 2.11.6 are susceptible to out-of-bounds read conditions that can be exploited to retrieve data from unauthorized memory areas, leaking sensitive information.

What to do

This vulnerability allows attackers to read arbitrary memory contents, potentially leaking sensitive information without any authentication required. This could lead to a loss of confidentiality, exposing your private data to prying eyes! An attacker could gain access to crucial information stored in memory, making this a critical threat. Immediately update your FreeRDP installation to version 3.5.0 or 2.11.6 to mitigate this issue. Since no workarounds are available, it’s critical to address this vulnerability without delay! You've got this! With a quick update, you'll lock down your Remote Desktop connections in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.03720 · 89.7th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-04-22T21:32Z
EPSS history
Timeline
  • 22 APR 21:32Z
    FreeRDP Out-Of-Bounds Read in ncrush_decompress
    cvelistv5