Buffer overflow in Freerdp
CVE-2026-31883
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.
Vulnerability class: Buffer Overflow
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N.
EPSS exploit prediction
EPSS: 0.003 (22.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Freerdp — versions < 3.24.0
Weakness classification (CWE)
References
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-85x9-4xxp-xhm5 (Exploit, Patch, Vendor Advisory)
- github.com/FreeRDP/FreeRDP/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8 (Patch)
Frequently asked questions
- What is CVE-2026-31883?
- CVE-2026-31883 is a medium-severity vulnerability in Freerdp, classified under Heap-based Buffer Overflow. CVSS score: 6.5/10. Published 2026-03-13.
- How severe is CVE-2026-31883?
- Medium severity. CVSS v3 base score is 6.5 out of 10.