Live › vulnerability › CVE-2026-114045
Go to dashboardFreeRDP before 3.32.1 has a heap buffer overflow in its server-side rdpsnd audio channel, caused by an integer wraparound in DVI_ADPCM block-alignment checks. A malicious RDP client can send crafted format PDUs to trigger an unbounded heap write, which could lead to code execution on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check whether the FreeRDP server library version is below 3.32.1 (e.g. pkg-config --modversion freerdp3 or the package manager query for freerdp).
Check whether your application runs a FreeRDP server with the rdpsnd audio channel enabled.
Upgrade FreeRDP to 3.32.1 or later and rebuild or redeploy any application that links it.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
This page as .md · .json · in your agent: get_signal("CVE-2026-114045")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.