CVE-2026-63117

MEDIUM 6.5

FreeRDP: Denial of service through ADPCM frame size calculation

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.

CWE	CWE-369
Vendor	freerdp
Product	freerdp
Published	Aug 19, 2026
Last Updated	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new medium vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

FreeRDP / FreeRDP

< 3.28.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-v64m-xxfw-hrv6 github.com: https://github.com/FreeRDP/FreeRDP/pull/12980 github.com: https://github.com/FreeRDP/FreeRDP/commit/b78fc0b138fe8f08a8b102e193ffb32986f4449a github.com: https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0