CVE-2026-63117

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.28.0

Description An authenticated RDP client can cause the server-side rdpsnd channel process to terminate by advertising DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2. This configuration results in the bs calculation within the rdpsnd server select format() function in channels/rdpsnd/server/rdpsnd main.c becoming zero. Consequently, the out frames modulo bs operation triggers a SIGFPE (Signal Floating-Point Exception), which is a signal sent to a process when a mathematical error occurs, such as division by zero.

Recommendations Update to version 3.28.0 or later.