CVE-2026-110837

FreeRDP 2.0.0 before 3.32.0, when built with WITH LAME=ON and WITH DSP FFMPEG=OFF, has a heap-based buffer overflow in freerdp dsp decode mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.