CVE-2026-63633: FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdpdspdecodeopus in libfreerdp/codec/dsp.c calls StreamEnsureRemainingCapacity on context->common.buffer even though opusdecode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVEFORMATOPUS with a client built with WITHOPUS enabled and WITHDSPFFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPoolTake destination used by channels/rdpsnd/client/rdpsndmain.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP/libfreerdp (libfreerdp_dsp_decode_opus in freerdp_dsp_decode_opus)to a version that resolves this vulnerability.Fixed in 3.28.0
Event History
Frequently Asked Questions
Which clients are exposed to this issue?
Clients using FreeRDP versions before 3.28.0 are exposed when built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The vulnerable path is reached when connecting to an RDP server that negotiates WAVE_FORMAT_OPUS audio.
What does an attacker need to exploit it?
An attacker needs to operate or control a malicious RDP server and have a vulnerable client connect to it. The server must negotiate Opus audio and send audio data that causes a decoded frame larger than the 4096-byte destination stream.
Is this a client-side or server-side risk?
This is a server-to-client issue. A malicious server can corrupt the heap of a connecting vulnerable FreeRDP client, potentially causing a crash or code execution.
What is the remediation?
Upgrade FreeRDP to version 3.28.0, which fixes the issue. The provided information does not specify a workaround for installations that cannot be upgraded.