CVE-2026-114045
Description
A flaw was found in FreeRDP. An integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation in the server-side rdpsnd channel. A malicious RDP client can send crafted SNDC_FORMATS PDUs, causing an unbounded heap write during server audio playback that may enable code execution. This issue affects FreeRDP before 3.32.1.
Statement
This issue is rated Important because an authenticated RDP client can trigger a heap-based buffer overflow in the FreeRDP server audio (rdpsnd) channel without further user interaction (PR:L, UI:N), with High impact on confidentiality, integrity, and availability. The vulnerable code is in the server-side rdpsnd path shipped when FreeRDP server components (for example freerdp-server / freerdp-shadow-cli) are built and used. Red Hat products that ship FreeRDP with server support before 3.32.1 are affected. Platform hardening such as ASLR, NX, and FORTIFY_SOURCE may make reliable exploitation more difficult but does not remove the underlying memory-corruption risk.
Mitigation
If FreeRDP server or shadow components are unused, remove or disable them.
Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
RH agrees with CNA for authenticated server exposure. AV:N — RDP server network service. AC:L — crafted SNDC_FORMATS then audio playback. PR:L — authenticated RDP client. UI:N — no additional user action. S:U. C:H/I:H/A:H — heap overflow with potential RCE. Score 8.8 maps to Important. FORTIFY/ASLR/NX may hinder exploitation but do not justify lowering CIA impacts.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart; DoS: Resource Consumption (CPU); DoS: Resource Consumption (Memory)
Buffer overflows generally lead to crashes. Other attacks leading to lack of availability are possible, including putting the program into an infinite loop.
Integrity,Confidentiality,Availability,Access Control
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Modify Memory
Buffer overflows often can be used to execute arbitrary code, which is usually outside the scope of a program's implicit security policy. Besides important user data, heap-based overflows can be used to overwrite function pointers that may be living in memory, pointing it to the attacker's code. Even in applications that do not explicitly use function pointers, the run-time will usually leave many in memory. For example, object methods in C++ are generally implemented using function pointers. Even in C programs, there is often a global offset table used by the underlying runtime.
Integrity,Confidentiality,Availability,Access Control,Other
Technical Impact: Execute Unauthorized Code or Commands; Bypass Protection Mechanism; Other
When the consequence is arbitrary code execution, this can often be used to subvert any other security service.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
