CVE-2026-114045

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.32.1

Description A heap-based buffer overflow exists in the server-side rdpsnd channel. This occurs due to an integer wraparound in the rdpsnd server select format() function during DVI ADPCM block-alignment arithmetic, which allows validation to be bypassed. A malicious RDP client can trigger this by sending two SNDC FORMATS PDUs with an nBlockAlign value that is too small for nChannels, leading to an unbounded heap write during server audio playback and potentially enabling remote code execution.

Recommendations Update to version 3.32.1 or later.