Heap-Based Buffer Overflow in FreeRDP Server-Side Audio Processing

CVE-2026-114045

What is CVE-2026-114045?

A vulnerability exists in FreeRDP prior to version 3.32.1 that allows a heap-based buffer overflow in the server-side RDPSND channel. The issue arises from an integer wraparound during block-alignment arithmetic within the rdpsnd_server_select_format() function, which fails to properly validate input. This flaw can be exploited by a malicious Remote Desktop Protocol (RDP) client capable of sending two SNDC_FORMATS Protocol Data Units (PDUs) with an nBlockAlign value that is too small for the designated number of channels. Exploiting this condition could result in an unbounded write to the heap during server audio playback, potentially allowing arbitrary code execution.

References