CVE-2026-114045

Received Received - Intake

Heap-based Buffer Overflow in FreeRDP

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114045

EUVD

EUVD-2026-106996

Affected Vendors & Products

Vendor	Product	Version / Range
FreeRDP	FreeRDP	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

This is a heap-based buffer overflow in FreeRDP versions before 3.32.1. It occurs in the server-side rdpsnd channel due to an integer wraparound in the rdpsnd_server_select_format() function. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback. This may enable code execution.

Detection Guidance

To detect this vulnerability, monitor FreeRDP versions before 3.32.1. Check the installed version using commands like 'xfreerdp --version' or 'apt show freerdp2-x11' on Debian-based systems. Inspect network traffic for RDP connections with malformed SNDC_FORMATS PDUs, particularly those with nBlockAlign values smaller than 4 * nChannels for DVI_ADPCM formats.

Impact Analysis

A malicious RDP client could exploit this to execute arbitrary code on the FreeRDP server. This could lead to unauthorized access, data theft, or system compromise. The attack requires minimal interaction, needing only two malformed PDUs followed by an audio playback event.

Compliance Impact

This vulnerability could potentially lead to unauthorized code execution on systems handling sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (healthcare data). Unauthorized access to personal or health data could result in breaches of confidentiality and integrity, triggering regulatory penalties or enforcement actions.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.32.1 or later. Disable the rdpsnd channel if audio redirection is not required. Apply network-level mitigations such as blocking or monitoring RDP traffic for suspicious format negotiation sequences. Ensure strict input validation for all RDP client communications.

Hi! I’m here to help you understand CVE-2026-114045. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...