FreeRDP up to 3.23.x libfreerdp/codec/dsp.c size_t integer underflow

Summaryinfo

A vulnerability labeled as critical has been found in FreeRDP up to 3.23.x. Impacted is an unknown function of the file libfreerdp/codec/dsp.c. Executing a manipulation of the argument size_t can lead to integer underflow. The identification of this vulnerability is CVE-2026-31883. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability has been found in FreeRDP up to 3.23.x and classified as critical. This vulnerability affects an unknown part of the file libfreerdp/codec/dsp.c. The manipulation of the argument size_t with an unknown input leads to a integer underflow vulnerability. The CWE definition for the vulnerability is CWE-191. The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-31883 since 03/09/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 302232 (Linux Distros Unpatched Vulnerability : CVE-2026-31883), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.24.0 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (302232), EUVD (EUVD-2026-12061) and CERT Bund (WID-SEC-2026-0725). Once again VulDB remains the best source for vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source FreeRDP

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion