Описание
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).
Отчет
This flaw is rated Important because crafted MP3 audio from a malicious RDP server can cause a heap buffer overflow in the client after the user connects (UI:R), with integrity and availability impact and limited confidentiality impact (CVSS 7.1). Decode-path constraints keep Attack Complexity High. Allocator hardening may impede exploitation but does not clear I:H/A:H.
Меры по смягчению последствий
If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | freerdp | Not affected | ||
| Red Hat Enterprise Linux 7 | freerdp | Affected | ||
| Red Hat Enterprise Linux 10 | freerdp | Fixed | RHSA-2026:94514 | 03.11.2026 |
| Red Hat Enterprise Linux 8 | freerdp | Fixed | RHSA-2026:94510 | 03.11.2026 |
| Red Hat Enterprise Linux 9 | freerdp | Fixed | RHSA-2026:93592 | 02.11.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
7.1 High
CVSS3
Связанные уязвимости
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP ...
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
EPSS
7.1 High
CVSS3