CVE-2026-114045: FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsndserverselectformat() DVIADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDCFORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.1+dfsg-0ubuntu0.24.04.1 - Upgrade
Upgrade
ubuntu/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.1+dfsg-0ubuntu0.26.04.1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.1
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP deployments acting as an RDP server and using the server-side rdpsnd audio channel are exposed. The vulnerable code is reached by a malicious RDP client during server audio playback.
What does an attacker need to exploit it?
An attacker needs network access to the RDP service and the ability to authenticate with low privileges. No user interaction is required; the attacker sends two crafted SNDC_FORMATS PDUs with an nBlockAlign value that is too small for nChannels.
Which versions should be remediated?
FreeRDP versions before 3.32.1 are affected. Upgrade to 3.32.1 or a later version.