CVE-2026-121387 in FreeRDP
Summary
by MITRE • 11/03/2026
FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows malicious RDP servers to read past audio buffers by sending truncated GSM610 frames. Attackers can negotiate GSM610 on rdpsnd and send a WAVE2 message shorter than a 33- or 32-byte WAV49 frame to crash the client.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in FreeRDP versions prior to 3.32.2 represents a critical security flaw within the audio processing subsystem, specifically located in the function responsible for decoding GSM610 encoded streams. This out-of-bounds read issue arises from insufficient validation of input data lengths during the decompression process. When an attacker controls the remote desktop server and negotiates the use of the GSM610 codec via the rdpsnd channel, they can exploit this logic error by transmitting a WAVE2 message that is shorter than the expected minimum frame size for WAV49 format frames, which typically require thirty-two or thirty-three bytes. Because the client application fails to verify that the incoming audio data meets these structural requirements before attempting to decode it, the decoder proceeds to access memory locations beyond the allocated buffer boundaries.
From a technical perspective, this flaw is classified under CWE-125, which denotes an out-of-bounds read vulnerability. The core issue lies in the lack of rigorous bounds checking prior to parsing the audio payload. In normal operation, FreeRDP expects well-formed GSM610 frames that adhere to specific length constraints defined by the RDP protocol specifications and codec standards. When a truncated frame is received, the decoding routine attempts to read data from memory addresses that are not part of the current buffer allocation. This behavior can lead to several adverse outcomes depending on how the operating system handles such illegal memory accesses. In many cases, this results in an immediate application crash or denial of service, disrupting the user's remote session and potentially causing instability for other processes sharing similar resources if heap corruption occurs.
The operational impact of this vulnerability is significant for organizations relying on FreeRDP for secure remote access infrastructure. An attacker with network-level access to a vulnerable RDP server can trigger this condition remotely without requiring authentication in some configurations, or by exploiting valid credentials if the session is already established. The ability to crash the client application effectively denies service to legitimate users and may serve as an initial vector for more sophisticated attacks if memory corruption leads to arbitrary code execution scenarios, although out-of-bounds reads are primarily associated with information disclosure or denial of service rather than direct code execution unless combined with other exploitation techniques. This aligns with MITRE ATT&CK technique T1499, Endpoint Denial of Service, as the primary observable effect is the disruption of system availability through application failure.
Mitigation strategies for this vulnerability involve immediate patching to version 3.32.2 or later, where developers have implemented stricter input validation checks within the GSM610 decoder routine. Administrators should ensure that all FreeRDP clients are updated across their infrastructure and consider implementing network-level authentication requirements to restrict access to RDP services only to authorized users. Additionally, deploying intrusion detection systems capable of identifying anomalous packet sizes or malformed protocol messages can provide an additional layer of defense against exploitation attempts while patching efforts are underway. Regular security audits and adherence to secure coding practices that emphasize input validation at every stage of data processing are essential for preventing similar vulnerabilities in future software updates.