CVE-2026-114045 FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format

High 8.7 Published 21 Oct 2026 Updated 21 Oct 2026

Exploited in the wild: Not known
Fix: Available

What is CVE-2026-114045?

CVE-2026-114045 is a high-severity vulnerability in FreeRDP, published on 21 Oct 2026.

Official description

FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.

Weakness: CWE-122

Which versions are affected by CVE-2026-114045?

How do I fix CVE-2026-114045?

Upgrade to a fixed version.

Is CVE-2026-114045 being exploited?

There is no known exploitation of CVE-2026-114045 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-114045, GHSA-3m9q-g533-rqjq, GHSA-mmcj-w3hp-5m84, UBUNTU-CVE-2026-114045.