CVE-2026-33977
Integer Overflow in FreeRDP Audio Redirection Causes Client Crash
Publication date: 2026-03-30
Last updated on: 2026-04-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| freerdp | freerdp | to 3.24.2 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-617 | The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in FreeRDP, a free implementation of the Remote Desktop Protocol. Before version 3.24.2, a malicious RDP server could crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (greater than or equal to 89). The client reads this unvalidated step index directly from the network and uses it to index into an 89-entry lookup table, which causes a WINPR_ASSERT() failure and forces the process to abort via SIGABRT.
This affects any FreeRDP client with audio redirection (RDPSND) enabled, which is the default setting. The issue was fixed in version 3.24.2.
How can this vulnerability impact me? :
The vulnerability can cause the FreeRDP client to crash unexpectedly when connected to a malicious RDP server that exploits this flaw. This crash occurs due to an assertion failure triggered by invalid audio data, leading to a denial of service condition for the user.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade your FreeRDP client to version 3.24.2 or later, where the issue has been patched.
Additionally, if upgrading immediately is not possible, consider disabling audio redirection (RDPSND) in the FreeRDP client as a temporary workaround, since the vulnerability affects clients with audio redirection enabled.