CVE-2026-63633

UNKNOWN 0.0

FreeRDP: Heap buffer overflow in Opus audio decode (`freerdp_dsp_decode_opus` resizes the wrong stream) — server→client

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.

CWE	CWE-122
Vendor	freerdp
Product	freerdp
Published	Aug 19, 2026

Stay Ahead of the Next One

Get instant alerts for freerdp freerdp

Be the first to know when new unknown vulnerabilities affecting freerdp freerdp are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

FreeRDP / FreeRDP

< 3.28.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xq github.com: https://github.com/FreeRDP/FreeRDP/pull/12993 github.com: https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae github.com: https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0