CVE-2024-22211

[CVE catalog]

Severity

High · CVSS 7.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Published

Jan 18, 2024, 11:00:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

1.08% · Oct 25, 2026

FreeRDP is a collection of remote desktop protocol library and client software that is both free and open source. An integer overflow within freerdp_bitmap_planar_context_reset results in a heap-buffer overflow. This impacts clients built on FreeRDP. However, server implementations and proxies based on FreeRDP are unaffected. A malevolent server could create a RDPGFX_RESET_GRAPHICS_PDU to allocate buffers that are too small, potentially causing subsequent out-of-bounds reads/writes. It's important to note that data extraction over the network is not feasible; these buffers are utilized solely for displaying images. freerdp: Integer Overflow leading to Heap Overflow in freerdp_bitmap_planar_context_reset This vulnerability in FreeRDP, resulting from an integer overflow in certain versions, poses a low severity risk due to several mitigating factors. Firstly, it primarily affects FreeRDP-based clients, while server implementations and proxies remain unaffected. Additionally, the potential for exploitation is limited as it requires interaction with a malicious server, and data extraction over the network is not feasible; the vulnerability pertains solely to image display buffers. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.