CVE-2026-114045: FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

Q: Who is exposed to this issue?

FreeRDP deployments acting as an RDP server and using the server-side rdpsnd audio channel are exposed. The vulnerable code is reached by a malicious RDP client during server audio playback.

Q: What does an attacker need to exploit it?

An attacker needs network access to the RDP service and the ability to authenticate with low privileges. No user interaction is required; the attacker sends two crafted SNDC_FORMATS PDUs with an nBlockAlign value that is too small for nChannels.

Q: Which versions should be remediated?

FreeRDP versions before 3.32.1 are affected. Upgrade to 3.32.1 or a later version.

Published Oct 21, 2026

Updated

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat() DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

Affected Software

1 affected component

FreeRDP freerdp<3.32.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.32.1

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

FreeRDP deployments acting as an RDP server and using the server-side rdpsnd audio channel are exposed. The vulnerable code is reached by a malicious RDP client during server audio playback.

What does an attacker need to exploit it?

An attacker needs network access to the RDP service and the ability to authenticate with low privileges. No user interaction is required; the attacker sends two crafted SNDC_FORMATS PDUs with an nBlockAlign value that is too small for nChannels.

Which versions should be remediated?

FreeRDP versions before 3.32.1 are affected. Upgrade to 3.32.1 or a later version.

CVE-2026-114045: FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions should be remediated?