Live › vulnerability › CVE-2026-121387
FreeRDP versions from 2.0.0 before 3.32.2 read past the end of an audio buffer when decoding GSM610 sound from an RDP server. A malicious server can send a short WAVE2 message to crash the client.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Anyone running a FreeRDP client from 2.0.0 before 3.32.2 that connects to RDP servers they do not fully trust. The crash is triggered by a server sending a malformed audio message, so the risk is mainly to clients connecting to untrusted or compromised hosts. unknown whether GSM610 is enabled by default.
No product ranges from the sources yet.
xfreerdp --version or the packaged version in your package manager3.32.2 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.
This page as .md · .json · in your agent: get_signal("CVE-2026-121387")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.