CVE-2026-110837

Undergoing Analysis Undergoing Analysis - In Progress

Heap-based Buffer Overflow in FreeRDP MP3 Audio Decoding

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: VulnCheck

Description

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110837

EUVD

EUVD-2026-101720

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	2.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This vulnerability is a heap-based buffer overflow in FreeRDP versions 2.0.0 before 3.32.0 when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF. It occurs in the freerdp_dsp_decode_mp3 function where a malicious RDP server can send MP3 audio via rdpsnd. The overflow happens because the right-channel PCM pointer is offset incorrectly, causing decoded samples to cross heap allocation boundaries and crash the client.

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is 2.0.0 before 3.32.0 and built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF. Use commands like 'freerdp --version' to verify the version. Inspect build configurations for the specified flags.

Impact Analysis

This vulnerability could allow a remote attacker to crash the FreeRDP client by sending specially crafted MP3 audio data. If exploited, it may lead to denial-of-service conditions, preventing legitimate users from accessing the RDP session. The impact is limited to client-side crashes and does not directly enable code execution or data theft.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a technical implementation flaw in FreeRDP's MP3 audio decoding. However, if exploited, it could lead to unauthorized access or data exfiltration, which may violate confidentiality requirements under these regulations.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.0 or later. Ensure the build configuration does not use WITH_LAME=ON and WITH_DSP_FFMPEG=OFF to avoid the heap-based buffer overflow.

Hi! I’m here to help you understand CVE-2026-110837. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70