What is CVE-2024-35164?

CVE-2024-35164 is a medium-severity vulnerability in Apache Guacamole, classified under Improper Validation of Array Index. CVSS score: 6.8/10. Published 2025-07-02.

How severe is CVE-2024-35164?

Medium severity. CVSS v3 base score is 6.8 out of 10.

Is CVE-2024-35164 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Apache Guacamole

CVE-2024-35164

The terminal emulator of Apache Guacamole 1.5.5 and older does not properly validate console codes received from servers via text-based protocols like SSH. If a malicious user has access to a text-based connection, a specially-crafted sequence of console codes could allow arbitrary code to be executed with the privileges of the running guacd process. Users are recommended to upgrade to version 1.6.0, which fixes this issue.

EPSS: 0.004 (35.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N.

Affected products

Apache Guacamole
Apache Software Foundation Guacamole — versions 0.8.0

Weakness classification (CWE)

CWE-129 — Improper Validation of Array Index

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108

Frequently asked questions

What is CVE-2024-35164?: CVE-2024-35164 is a medium-severity vulnerability in Apache Guacamole, classified under Improper Validation of Array Index. CVSS score: 6.8/10. Published 2025-07-02.
How severe is CVE-2024-35164?: Medium severity. CVSS v3 base score is 6.8 out of 10.
Is CVE-2024-35164 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.