CVE-2026-63633
Received Received - Intake

Heap Corruption in FreeRDP via Opus Decode

Publication date: 2026-08-19

Last updated on: 2026-08-19

Assigner: GitHub, Inc.

Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-19
Last Modified
2026-08-19
Generated
2026-08-19
AI Q&A
2026-08-19
EPSS Evaluated
N/A
NVD
CVE-2026-63633
EUVD
EUVD-2026-62672

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
freerdp freerdp to 3.28.0 (inc)
freerdp freerdp to 3.27.1 (inc)
freerdp freerdp 3.28.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-63633 is a heap buffer overflow in FreeRDP's Opus audio decoding function, freerdp_dsp_decode_opus. It affects versions 3.0.0 through 3.27.1. The flaw occurs because the function incorrectly resizes the wrong stream before decoding. It calls Stream_EnsureRemainingCapacity on context->common.buffer but writes decoded PCM into a fixed 4096-byte caller-supplied out stream. The Opus decoder can write up to 5760 samples per channel (about 19 KB for stereo), exceeding the buffer size. This corrupts heap memory and may allow remote code execution.

Detection Guidance

To detect this vulnerability, check if your FreeRDP version is between 3.0.0 and 3.27.1. Run 'xfreerdp --version' or 'freerdp2 --version' to verify. Monitor network traffic for RDP connections using Opus audio format. Enable AddressSanitizer or similar tools during compilation to detect heap overflows.

Impact Analysis

If you use a vulnerable FreeRDP client (versions 3.0.0 to 3.27.1) with audio redirection enabled, a malicious RDP server could exploit this flaw by negotiating the WAVE_FORMAT_OPUS audio format. The server sends a crafted Opus wave PDU, causing a heap overflow. This can crash your client, corrupt memory, and potentially allow the attacker to execute arbitrary code on your system. No user interaction beyond connecting to the server is required.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling remote code execution (RCE) through a heap buffer overflow. If exploited, it may allow unauthorized access to sensitive data processed by FreeRDP clients, violating confidentiality requirements under these regulations. The lack of user interaction required for exploitation increases the risk of unauthorized data exposure or modification.

Mitigation Strategies

Upgrade FreeRDP to version 3.28.0 or later immediately. Disable audio redirection if not required by setting 'audio redirection' to 'off' in client configuration. Block RDP connections from untrusted servers until patched. Monitor for unusual memory corruption or crashes in FreeRDP processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63633. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart