PT-2026-114151 · Freerdp · Freerdp
CVSS v3.1
7.1
High
| Vector | AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H |
FreeRDP 2.0.0 before 3.32.0, when built with WITH LAME=ON and WITH DSP FFMPEG=OFF, has a heap-based buffer overflow in freerdp dsp decode mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
Fix
Heap Based Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Freerdp