CVE-2024-35164 — Improper Validation of Array Index in Apache Guacamole

CWE-129 — Improper Validation of Array Index6 documents6 sources
Severity
7.5HIGHNVD
CNA6.8
EPSS
0.1%
top 83.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Apache GuacamoleApache Software Foundation Apache Guacamole
Timeline
PublishedJul 2
Latest updateOct 15

Description

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages2 packages

▶NVDapache/guacamole0.8.0 — 1.6.0

🔴Vulnerability Details

3
CVEList
Apache Guacamole: Improper input validation of console codes↗2025-07-02
▶
OSV
CVE-2024-35164: The terminal emulator of Apache Guacamole 1↗2025-07-02
▶
GHSA
GHSA-8wh3-jcvc-qrmq: The terminal emulator of Apache Guacamole 1↗2025-07-02
▶

📋Vendor Advisories

2
Oracle
Oracle Oracle Communications Applications Risk Matrix: Core (Apache Guacamole) — CVE-2024-35164↗2025-10-15
▶
Apache
Apache guacamole: CVE-2024-35164↗
▶
CVE-2024-35164 — Improper Validation of Array Index | cvebase