DEBIAN-CVE-2026-121387: Medium severity debian/freerdp2 vulnerability
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdpdspdecodegsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Clients using Debian freerdp2 or freerdp3 are exposed when they connect to a malicious RDP server that can negotiate the GSM610 audio format over rdpsnd.
What does an attacker need to exploit the vulnerability?
The attacker needs to operate or control an RDP server that a user connects to. The server can then send a truncated GSM610 WAVE2 audio message shorter than a 33- or 32-byte WAV49 frame.
What is the practical impact of successful exploitation?
The described impact is a client crash caused by an out-of-bounds read past the audio buffer. The provided data does not indicate confidentiality or integrity impact.