CVE-2026-121387: FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder

Q: Which systems are exposed to this issue?

FreeRDP clients in versions from 2.0.0 through versions before 3.32.2 are exposed when they connect to a malicious RDP server that can negotiate GSM610 audio through rdpsnd. The listed affected software includes Debian freerdp2, Debian freerdp3, and FreeRDP freerdp.

Q: What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a user connects to. The server must negotiate GSM610 and send an undersized WAVE2 audio message containing a truncated 33-byte or 32-byte WAV49 frame; user interaction is required because the client must connect.

Q: What is the expected impact?

The malformed audio frame causes an out-of-bounds read in freerdp_dsp_decode_gsm610 and can crash the FreeRDP client. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

Published Nov 3, 2026

Updated

FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdpdspdecodegsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.

Affected Software

6 affected componentsFixes available

FreeRDP freerdp>=2.0.0<3.32.2

debian/freerdp2*

debian/freerdp3*

debian/freerdp3<3.32.2+dfsg-1

3.32.2+dfsg-1

debian/freerdp2<=2.11.7+dfsg1-6~deb12u1

debian/freerdp3<=3.15.0+dfsg-2.1+deb13u3

3.32.2+dfsg-13.33.0+dfsg-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1
Upgrade
Upgrade debian/freerdp3 to a version that resolves this vulnerability.
Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1

Event History

Nov 3, 2026

CVE Published

via MITRE·02:27 PM

Data Sourced

via MITRE·02:27 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:17 PM

DescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·03:17 PM

Affected Software

Frequently Asked Questions

Which systems are exposed to this issue?

FreeRDP clients in versions from 2.0.0 through versions before 3.32.2 are exposed when they connect to a malicious RDP server that can negotiate GSM610 audio through rdpsnd. The listed affected software includes Debian freerdp2, Debian freerdp3, and FreeRDP freerdp.

What does an attacker need to exploit it?

An attacker needs to operate or control an RDP server that a user connects to. The server must negotiate GSM610 and send an undersized WAVE2 audio message containing a truncated 33-byte or 32-byte WAV49 frame; user interaction is required because the client must connect.

What is the expected impact?

The malformed audio frame causes an out-of-bounds read in freerdp_dsp_decode_gsm610 and can crash the FreeRDP client. The supplied severity vector indicates availability impact only, with no stated confidentiality or integrity impact.

CVE-2026-121387: FreeRDP 2.0.0 before 3.32.2 Out-of-Bounds Read via GSM610/WAV49 Decoder

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact?