FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-develUpgrade libwinprUpgrade freerdp-libs | May 12, 2026 | May 11, 2026 |
| Alpine Linux | — | Upgrade freerdp | Mar 16, 2026 | Mar 13, 2026 |
| Amazon Linux Ami 2 | — | Upgrade freerdpUpgrade libwinpr-develUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-libsUpgrade libwinpr | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade freerdp-libs-debuginfoUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdp-libsUpgrade freerdpUpgrade freerdp-server-debuginfoUpgrade libwinpr-develUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-debugsourceUpgrade freerdp-debuginfo | Apr 7, 2026 | Mar 13, 2026 |
| Debian | — | Upgrade freerdp3 | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-serverUpgrade freerdp-libs | May 13, 2026 | Mar 13, 2026 |
| Redhat_linux | — | Upgrade libwinpr-develUpgrade freerdp-libsUpgrade freerdp-serverUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade libwinprNo solution existsUpgrade freerdpUpgrade freerdp-server-debuginfo | May 12, 2026 | Mar 13, 2026 |
| Rocky_linux | — | Upgrade freerdp-libsUpgrade freerdp-serverUpgrade libwinprUpgrade freerdp-develUpgrade libwinpr-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-server-debuginfo | May 14, 2026 | May 13, 2026 |
| Ubuntu | — | Upgrade freerdp3-x11Upgrade libfreerdp3-3Upgrade freerdp-x11 | Jul 21, 2026 | Jul 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub