CVE-2026-110837: FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding
FreeRDP 2.0.0 before 3.32.0, when built with WITHLAME=ON and WITHDSPFFMPEG=OFF, has a heap-based buffer overflow in freerdpdspdecodemp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
FreeRDP versions from 2.0.0 before 3.32.0 are affected only when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF. Deployments using a different build configuration are not identified as affected by the provided information.
What does an attacker need to exploit it?
An attacker needs to operate or control a malicious RDP server that the FreeRDP client connects to. The server can then send MP3 audio through the rdpsnd channel to trigger the overflow during decoding.
What is the expected impact of successful exploitation?
The described outcome is decoded audio samples crossing a heap allocation, which can crash the FreeRDP client. The supplied severity vector also indicates low confidentiality impact and high integrity and availability impact.
How can I determine whether a client is exposed?
Check the installed FreeRDP version and the build options used for that package or binary. A client is in scope if it is version 2.0.0 through a release before 3.32.0 and was built with WITH_LAME enabled while WITH_DSP_FFMPEG is disabled.