PT-2026-29134 · Freerdp+1 · Freerdp+1

Sebasteuo · Published 2026-01-01 · Updated 2026-06-15 · CVE-2026-33977

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.2

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol (RDP) server can cause a FreeRDP client to crash by sending audio data in IMA ADPCM format with an invalid initial step index value (greater than or equal to 89). The unvalidated step index is read directly from the network and used to index into a lookup table, triggering a failure and process termination. This affects any FreeRDP client with audio redirection (RDPSND) enabled, which is the default configuration.

Recommendations Update to FreeRDP version 3.24.2 or later.

Exploit

Fix

DoS

Assertion Failure

Weakness Enumeration

CWE-617

Related Identifiers

BDU:2026-04669

CVE-2026-33977

GHSA-8F2G-3Q27-6XM5

OPENSUSE-SU-2026:10633-1

OPENSUSE-SU-2026:20657-1

SUSE-SU-2026:21436-1

Affected Products

Freerdp

Red Os

References · 25

• 🔥 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33977.json · Exploit
• https://github.com/FreeRDP/FreeRDP/commit/9be3f03d94a50892fd58a9f7dee72b2313c69b47 · Patch
• https://bdu.fstec.ru/vul/2026-04669 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-33977 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33977 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-33977 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-33977 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-33977 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-33977 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33977 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:10633-1 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-33986 · Note
• https://twitter.com/CVEnew/status/2038916076101378336 · Twitter Post
• https://suse.com/security/cve/CVE-2026-33983 · Note