CVE-2026-31883 FreeRDP has a `size_t` underflow in ADPCM decoder leads to heap-buffer-overflow write
A size_t underflow in FreeRDP's ADPCM decoders causes a heap-buffer-overflow write, potentially allowing remote code execution or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31883?
CVE-2026-31883 is a medium-severity vulnerability in Freerdp Freerdp, published on 13 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.
Which versions are affected by CVE-2026-31883?
It affects 1 product.
Products include Freerdp Freerdp.
How do I fix CVE-2026-31883?
Upgrade to a fixed version.
Is CVE-2026-31883 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-31883 exists.
Other vulnerabilities in Freerdp Freerdp
- CVE-2021-37594 Other in n/a
- CVE-2021-37595 Other in n/a
- CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr
- CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass
- CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection
Sources
Also known as DEBIAN-CVE-2026-31883, GHSA-85x9-4xxp-xhm5, MINI-3h55-g6h5-gh4j, UBUNTU-CVE-2026-31883.