CVE-2026-121387
Undergoing Analysis Undergoing Analysis - In Progress

Out-of-Bounds Read in FreeRDP via Truncated GSM610 Frames

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121387
EUVD
EUVD-2026-115919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP versions 2.0.0 through 3.32.1 have an out-of-bounds read flaw in the GSM610/WAV49 audio decoder function freerdp_dsp_decode_gsm610. A malicious RDP server can send truncated GSM610 frames shorter than 33 or 32 bytes, causing the client to read memory past allocated audio buffers and potentially crash.

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is between 2.0.0 and 3.32.1, the system is vulnerable. Monitor network traffic for RDP connections negotiating GSM610 audio codec and inspect WAVE2 messages for truncated WAV49 frames shorter than 33 or 32 bytes.

Impact Analysis

This vulnerability can cause the FreeRDP client to crash, leading to a denial of service. It does not allow arbitrary code execution, data leakage, or integrity compromise but may disrupt remote desktop sessions.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.2 or later immediately. Disable the GSM610 audio codec in RDP client configurations if possible. Block or restrict untrusted RDP servers from connecting to your network. Apply network-level monitoring to detect and block malformed audio frames.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121387. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...