PT-2026-25336 · Freerdp · Freerdp

Yjk0805

·

Published

2026-01-01

·

Updated

2026-03-25

·

CVE-2026-31883

CVSS v3.1

9.8

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0
Description FreeRDP is a free implementation of the Remote Desktop Protocol. A size t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to a heap-buffer-overflow write via the RDPSND audio channel. The issue occurs in libfreerdp/codec/dsp.c where the decoders subtract block header sizes from a size t variable without checking for underflow. Specifically, when nBlockAlign (received from the server) is set in a way that triggers header parsing at a point where the size is smaller than the header (4 or 8 bytes), the subtraction wraps the size to a large value. This causes the while (size > 0) loop to iterate excessively.
Recommendations Update to version 3.24.0 or later.

Exploit

Fix

Heap Based Buffer Overflow

Integer Underflow

Weakness Enumeration

CWE-122CWE-191

Related Identifiers

CVE-2026-31883
OPENSUSE-SU-2026:10408-1

Affected Products

Freerdp