CVE-2026-110837
Description
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).
Statement
This flaw is rated Important because crafted MP3 audio from a malicious RDP server can cause a heap buffer overflow in the client after the user connects (UI:R), with integrity and availability impact and limited confidentiality impact (CVSS 7.1). Decode-path constraints keep Attack Complexity High. Allocator hardening may impede exploitation but does not clear I:H/A:H.
Mitigation
If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.1 | N/A | 7.1 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | None | N/A | Low |
| User Interaction | Required | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | Low | N/A | Low |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H
Red Hat CVSS v3 Score Explanation
Client must connect to a malicious RDP server (UI:R). MP3/DSP decode path raises attack complexity (AC:H). Heap overflow may corrupt memory (I:H/A:H) with limited disclosure (C:L).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
