CVE-2026-33977 FreeRDP: DoS via WINPR_ASSERT in IMA ADPCM audio decoder (dsp.c:331)

Medium 6.9 Published 30 Mar 2026 Updated 31 Mar 2026

A malicious RDP server can crash the FreeRDP client by sending invalid IMA ADPCM audio data, causing an assertion failure and process abort.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2026-33977?

CVE-2026-33977 is a medium-severity denial of service vulnerability in Freerdp Freerdp, published on 30 Mar 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.

Weakness: CWE-617

Which versions are affected by CVE-2026-33977?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-33977?

Upgrade to a fixed version.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-33977 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33977 exists.

All Freerdp Freerdp vulnerabilities

Sources

Also known as DEBIAN-CVE-2026-33977, GHSA-8f2g-3q27-6xm5, UBUNTU-CVE-2026-33977.