CVE-2024-35164 Apache Guacamole: Improper input validation of console codes
A malicious user with access to a text-based connection can execute arbitrary code on the server via crafted console codes in Apache Guacamole.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-35164?
CVE-2024-35164 is a medium-severity code injection vulnerability in Apache Guacamole, published on 2 Jul 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process.
Users are recommended to upgrade to version 1.6.0, which fixes this issue.
Weakness: CWE-129
Which versions are affected by CVE-2024-35164?
It affects 1 product.
Products include Apache Guacamole.
How do I fix CVE-2024-35164?
No fix has been published for CVE-2024-35164 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2024-35164 being exploited?
There is no known exploitation of CVE-2024-35164 in the wild and no public exploit code.
Other vulnerabilities in Apache Guacamole
- CVE-2021-43999 Improper validation of SAML responses
- CVE-2017-3158 Apache Guacamole Race Condition vulnerability
- CVE-2023-43826 Apache Guacamole: Integer overflow in handling of VNC image buffers
- CVE-2019-19603 Null dereference in n/a
- CVE-2018-1340 Missing Encryption of Sensitive Data in Apache Guacamole
Sources
Also known as GHSA-8wh3-jcvc-qrmq, UBUNTU-CVE-2024-35164.