FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | Upgrade freerdp-libs-debuginfoUpgrade freerdp-debuginfoUpgrade libwinpr-develUpgrade freerdp-serverUpgrade libwinpr-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-libsUpgrade libwinprUpgrade freerdp-develUpgrade freerdpUpgrade freerdp-server-debuginfo | Aug 24, 2026 | Aug 19, 2026 |
| Rocky_linux | — | Upgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-libs-debuginfoUpgrade libwinprUpgrade freerdp-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-serverUpgrade freerdp-libsUpgrade freerdp-develUpgrade freerdp-server-debuginfo | Sep 3, 2026 | Sep 1, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 30, 2026 | Aug 20, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub