CVE-2024-32460: 
NixOS vulnerability analysis and mitigation

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). A vulnerability was discovered in FreeRDP clients using /bpp:32 legacy GDI drawing path with versions prior to 3.5.0 or 2.11.6, making them vulnerable to out-of-bounds read. The vulnerability was identified and reported by Evgeny Legerov of Kaspersky Lab (GitHub Advisory).

The vulnerability (CVE-2024-32460) is an out-of-bounds read issue in the interleaved_decompress function. The CVSS v3.1 base score is 9.8 CRITICAL according to NVD assessment, while GitHub rates it as 8.1 HIGH with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue occurs in the legacy GDI drawing path when processing certain memory operations (NVD).

If a user were tricked into connecting to a malicious server, a remote attacker could possibly use this issue to cause FreeRDP to crash, resulting in a denial of service (Ubuntu Notice).

The vulnerability has been patched in FreeRDP versions 3.5.0 and 2.11.6. As a workaround, users can use modern drawing paths (e.g. /rfx or /gfx options), though this requires server side support (GitHub Advisory, FreeRDP Release).

The vulnerability was addressed promptly with releases 2.11.6 and 3.5.0, which received positive community reactions on GitHub. The releases addressing this and other security issues garnered multiple positive reactions including thumbs up, rocket, and heart emojis from the community (FreeRDP Release).