PT-2026-25336 · Freerdp+1 · Freerdp+1
Yjk0805
·
Publicado
2026-01-01
·
Atualizado
2026-05-12
·
CVE-2026-31883
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
FreeRDP versions prior to 3.24.0
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. A size t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to a heap-buffer-overflow write via the RDPSND audio channel. The issue occurs in
libfreerdp/codec/dsp.c where the decoders subtract block header sizes from a size t variable without checking for underflow. Specifically, when nBlockAlign (received from the server) is set in a way that triggers header parsing at a point where the size is smaller than the header (4 or 8 bytes), the subtraction wraps the size to a large value. This causes the while (size > 0) loop to iterate excessively.Recommendations
Update to version 3.24.0 or later.
Exploit
Correção
Integer Underflow
Heap Based Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Freerdp
Rocky Linux