CVE-2026-31884

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.24.0

Description FreeRDP is a free implementation of the Remote Desktop Protocol. A division by zero error exists in the MS-ADPCM and IMA-ADPCM decoders when the nBlockAlign variable is 0, resulting in a crash. The issue occurs in libfreerdp/codec/dsp.c where the decoders use size % block size, with block size equal to context->common.format.nBlockAlign. The nBlockAlign value originates from the Server Audio Formats PDU on the RDPSND channel and is not validated before being used in the decoder. When nBlockAlign is 0, a SIGFPE (floating point exception) crash occurs.

Recommendations Versions prior to 3.24.0 should be updated to version 3.24.0 or later.