Division by Zero Vulnerability in FreeRDP Remote Desktop Protocol Implementation

CVE-2026-31884

What is CVE-2026-31884?

The FreeRDP project, an open-source implementation of the Remote Desktop Protocol, has a significant vulnerability that arises from improper validation of the nBlockAlign parameter in its audio decoders. Specifically, prior to version 3.24.0, the MS-ADPCM and IMA-ADPCM decoders do not check if the nBlockAlign value is zero. This oversight enables a division by zero condition, leading to a SIGFPE (floating point exception) crash when processing audio data. This vulnerability can affect system stability and performance, particularly when utilizing the RDPSND channel for audio functionality. Users are strongly urged to upgrade to version 3.24.0 or later to mitigate this issue.

References