CVE-2026-63117: FreeRDP: Denial of service through ADPCM frame size calculation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the bs calculation in rdpsndserverselectformat in channels/rdpsnd/server/rdpsndmain.c equal zero. The subsequent outframes modulo bs operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions prior to 3.28.0 are affected when acting as an RDP server with the server-side rdpsnd channel process reachable by an authenticated RDP client.
What does an attacker need to do to trigger the denial of service?
The attacker needs valid RDP authentication and must advertise DVI ADPCM audio using nBlockAlign of 8 and nChannels of 2. This causes the frame-size calculation to become zero and a subsequent modulo operation terminates the server-side rdpsnd channel process with SIGFPE.
What is the remediation?
Upgrade FreeRDP to version 3.28.0 or later, which includes the fix.