CVE-2026-110837

Name of the Vulnerable Software and Affected Versions FreeRDP versions 2.0.0 through 3.31.0

Description A heap-based buffer overflow exists in the freerdp dsp decode mp3() function when the software is built with WITH LAME=ON and WITH DSP FFMPEG=OFF. The issue occurs because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can exploit this by sending crafted MP3 audio over rdpsnd, causing decoded samples to exceed the heap allocation and crash the client.

Recommendations Update FreeRDP to version 3.32.0 or later.