CVE-2026-114045: 
Wolfi vulnerability analysis and mitigation

CVE-2026-114045 is a heap-based buffer overflow vulnerability in FreeRDP's server-side rdpsnd audio channel, caused by an integer wraparound in rdpsnd_server_select_format() during DVI_ADPCM block-alignment arithmetic. All FreeRDP versions before 3.32.1 are affected, including the master branch up to commit 8ec6d3923b (2026-09-23) and all stable 3.x releases through 3.32.0. The vulnerability was disclosed on October 21, 2026, and is classified as a bypass of the earlier CVE-2026-63117 fix. It carries a CVSS v3.1 score of 8.8 (High) for post-authentication scenarios, and up to 9.8 (Critical) for unauthenticated deployments (GitHub Advisory, GHSA-mmcj-w3hp-5m84).

The root cause is a two-stage flaw classified as CWE-122 (Heap-Based Buffer Overflow) via CWE-190 (Integer Overflow or Wraparound). In rdpsnd_server_recv_formats(), the parse-time validation for WAVE_FORMAT_DVI_ADPCM only checks nBlockAlign >= 4 but does not enforce the codec-consistency constraint nBlockAlign >= 4 * nChannels. An attacker sends a crafted SNDC_FORMATS PDU with nBlockAlign=4 and nChannels=2; in rdpsnd_server_select_format(), the expression 4ULL * (nBlockAlign - 4ULL * nChannels) computes 4 - 8 as an unsigned 64-bit subtraction, wrapping to 0xFFFFFFFFFFFFFFFC, and then multiplying by 4 yields 0xFFFFFFFFFFFFFFF0 — a value that passes all existing WINPR_ASSERT guards. The corrupted out_frames value is committed to state before the realloc() call fails; integrator call sites (e.g., shadow_rdpsnd.c) log a warning and continue, leaving the channel in a corrupted state. The subsequent rdpsnd_server_send_samples() call then writes up to 16,384 bytes into the original ~8,820-byte heap buffer, yielding an unbounded sequential heap write (GitHub Advisory).

Successful exploitation allows an authenticated (or unauthenticated, in misconfigured deployments) remote attacker to achieve arbitrary code execution on the FreeRDP server with the privileges of the server process. The unbounded heap write provides a remote-code-execution class primitive, with full confidentiality, integrity, and availability impact on the affected server. Compromised servers could serve as pivot points for lateral movement within the network, and any data accessible to the server process — including credentials, session data, and files — is at risk (GitHub Advisory, GHSA-mmcj-w3hp-5m84).

A runtime verification proof-of-concept (PocRdpsndOverflow.c) was developed by the reporter (Kanishka De Silva / HEXERLAB) and confirmed with AddressSanitizer on Ubuntu 24.04, but no public exploit code has been released as of disclosure. There is no evidence of in-the-wild exploitation, and the EPSS score is 0.0. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires low privileges (a valid RDP client connection) in default configurations, but no privileges in unauthenticated deployments (GitHub Advisory, Feedly).

1. Reconnaissance: Identify FreeRDP-based RDP servers (versions < 3.32.1) exposed on the network using tools like Shodan or Censys, or by banner-grabbing on TCP port 3389.
2. Authenticate: Establish a valid RDP client connection to the target server (low-privilege credentials suffice in default configurations; no credentials needed in unauthenticated deployments).
3. Send Stage 1 — Benign PCM format: Transmit a SNDC_FORMATS PDU advertising a benign WAVE_FORMAT_PCM format (e.g., 2 channels, 44100 Hz, nBlockAlign=4). This causes the server to allocate a legitimate out_buffer (e.g., ~8,820 bytes) via rdpsnd_server_select_format().
4. Send Stage 2 — Malicious DVI_ADPCM format: Transmit a second SNDC_FORMATS PDU with WAVE_FORMAT_DVI_ADPCM, nChannels=2, and nBlockAlign=4. This triggers the integer wraparound in rdpsnd_server_select_format(), setting out_frames to 0xFFFFFFFFFFFFFFF0 while the realloc() fails and the server continues with the corrupted state.
5. Trigger audio playback: Initiate any server-side audio playback event, causing rdpsnd_server_send_samples() to write up to 16,384 bytes into the original ~8,820-byte heap buffer — overflowing by ~7,564 bytes per call.
6. Achieve code execution: Leverage the unbounded, sequential heap write to corrupt adjacent heap metadata or function pointers, ultimately redirecting execution to attacker-controlled code running with server process privileges (GitHub Advisory).

• Network: Unexpected or repeated SNDC_FORMATS PDUs from an RDP client, particularly advertising WAVE_FORMAT_DVI_ADPCM with nBlockAlign=4 and nChannels=2; anomalous RDP audio channel traffic patterns from a single client.
• Logs: FreeRDP server logs containing [rdpsnd_server_select_format]: realloc failed! warnings followed by continued operation; repeated SelectFormat failed warnings in shadow_rdpsnd or related integrator logs.
• Process: Unexpected child processes spawned by the FreeRDP server process (e.g., shells, network utilities); crashes or core dumps from the FreeRDP server process with stack traces referencing rdpsnd_server_send_samples or rdpsnd_main.c:770.
• File System: Unexpected files written by the FreeRDP server process; core dump files in the server working directory following a crash during audio playback.

The primary remediation is to upgrade FreeRDP to version 3.32.1 or later, which addresses the integer wraparound by adding the codec-consistency constraint nBlockAlign >= 4 * nChannels at parse time and committing state only after successful allocation (GitHub Advisory, GHSA-mmcj-w3hp-5m84). As interim mitigations, restrict RDP server access to trusted clients only using firewall rules or VPN, implement network segmentation to limit which systems can connect to FreeRDP-based RDP servers, and disable server-side audio redirection if not required. Monitor RDP traffic for suspicious audio channel activity, particularly repeated SNDC_FORMATS PDUs with anomalous format parameters (Red Hat Bugzilla).

The vulnerability was reported by Kanishka De Silva (HEXER / HEXERLAB) and published via the FreeRDP GitHub Security Advisory program. Red Hat has opened a tracking bug (Bugzilla #2557974) and classified the issue as high severity. No broader media coverage or notable social media commentary has been identified at the time of disclosure.