CVE-2026-110837

HIGH 7.1

FreeRDP 2.0.0 before 3.32.0 Heap Buffer Overflow via MP3 Audio Decoding

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.

CWE	CWE-122
Vendor	freerdp
Product	freerdp
Published	Oct 14, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new high vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Affected Versions

FreeRDP / FreeRDP

2.0.0 < 3.32.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-52xc-5973-w5vv vulncheck.com: https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.0-heap-buffer-overflow-via-mp3-audio-decoding

Credits

Kushalkhemka mayank-jangid-moon skigeek16 opensec-intelligence