PT-2026-29134 · Freerdp+1 · Freerdp+1

Sebasteuo · Publicado 2026-01-01 · Atualizado 2026-06-15 · CVE-2026-33977

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol (RDP) server can cause a FreeRDP client to crash by sending audio data in IMA ADPCM format with an invalid initial step index value (greater than or equal to 89). The unvalidated step index is read directly from the network and used to index into a lookup table, triggering a failure and process termination. This affects any FreeRDP client with audio redirection (RDPSND) enabled, which is the default configuration.

Recommendations Update to FreeRDP version 3.24.2 or later.

Exploit

Correção

DoS

Assertion Failure

Enumeração de Fraquezas

CWE-617

Identificadores relacionados

BDU:2026-04669

CVE-2026-33977

GHSA-8F2G-3Q27-6XM5

OPENSUSE-SU-2026:10633-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:21436-1

Produtos afetados

Freerdp

Red Os

Referências · 25

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33977.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/9be3f03d94a50892fd58a9f7dee72b2313c69b47 · Correção
• https://bdu.fstec.ru/vul/2026-04669 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33977 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-33986 · Nota
• https://twitter.com/CVEnew/status/2038916076101378336 · Publicação no Twitter
• https://suse.com/security/cve/CVE-2026-33983 · Nota
• https://suse.com/security/cve/CVE-2026-33984 · Nota
• https://osv.dev/vulnerability/CVE-2026-33977 · Aviso do Fabricante
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33977 · Aviso do Fabricante
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti-red-os-8-0/uyazvimost-freerdp3-cve-2026-33977-8.0 · Nota
• https://ubuntu.com/security/CVE-2026-33977 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2026-33977 · Nota de Segurança
• https://suse.com/security/cve/CVE-2026-33987 · Nota