CVE-2026-114045
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel…
- Risk score
- 61/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.5%
- Published
- 21 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causi…
- Affected
- See advisory
- Fix
- Upgrade the product to 3.32.1 or later.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.8 high
References
Original description
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
Last activity 21 Oct 2026. Patch Forecast updates every hour.