High priorityDisclosed

Advisory · CVE-2026-114045

FreeRDP server heap overflow in the sound channel can give a malicious client code execution

FreeRDP before 3.32.1 has a heap-based buffer overflow in the server-side rdpsnd channel: an integer wraparound in block-alignment arithmetic bypasses validation, so a malicious RDP client can cause an unbounded heap write during server audio playback. CVSS 3.1 8.8.

Advisory published October 21, 2026Independent summary
Vendor
FreeRDP
Product
FreeRDP
Identifier / CWE
CVE-2026-114045
CWE-122
Action timing
Immediate
ELI5

Explain it like I’m five

A connecting client can hand the FreeRDP server sound settings whose sizes wrap around the check, so the server writes far past the memory it set aside while playing audio.

SIMPLIFIED_ATTACK_PATH05 STEPS
  1. 01Malicious client connects

    A client with low privileges connects to a FreeRDP server and opens the rdpsnd sound channel.

  2. 02Crafted formats sent

    The client sends SNDC_FORMATS messages with an nBlockAlign value too small for the stated channel count.

  3. 03Validation wraps around

    Integer wraparound in the DVI_ADPCM block-alignment arithmetic in rdpsnd_server_select_format bypasses the validation.

  4. 04Heap write during playback

    The server performs an unbounded heap write while handling server audio playback.

  5. 05Code execution possible

    Per the project advisory record, the heap write can potentially enable code execution on the server.

What happened

The FreeRDP project disclosed CVE-2026-114045: a heap-based buffer overflow (CWE-122) in the server-side rdpsnd channel of FreeRDP before 3.32.1. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation when a malicious RDP client supplies an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution. The CVSS 3.1 score is 8.8, with network attack vector, low complexity, low privileges required, and no user interaction.

Per the affected data in the NVD record, versions before 3.32.1 are affected and 3.32.1 is listed as unaffected, so upgrading to FreeRDP 3.32.1 or later is the stated fix.

What to do

  1. Inventory FreeRDP servers and gateways, including packages bundled by distributions, appliances, and remote-access products, and note the version of each.
  2. Upgrade affected servers to FreeRDP 3.32.1 or later using the project release guidance.
  3. Restrict network access to RDP services to gateway and admin paths only while remediation is underway; do not expose FreeRDP servers directly beyond their intended audience.
  4. Hunt for FreeRDP server crashes, heap corruption faults, and clients sending repeated or malformed sound channel format messages.
  5. Verify the deployed version after updating, and confirm the rdpsnd channel still works for legitimate clients.

Management note

FreeRDP servers sit on remote-access paths by design, and this flaw lets a connecting client attack the server itself. Put FreeRDP servers on the urgent patch ring and keep them behind a gateway wherever you can.