CVE-2026-31883: 
NixOS vulnerability analysis and mitigation

CVE-2026-31883 is a heap-buffer-overflow vulnerability in FreeRDP's IMA-ADPCM and MS-ADPCM audio decoders, caused by a size_t integer underflow in libfreerdp/codec/dsp.c. It affects all FreeRDP versions prior to 3.24.0 and was disclosed on March 13, 2026. The vulnerability is reachable via the RDPSND audio channel during an RDP session. NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while the GitHub Security Advisory rates it 6.5 (Moderate) using a more conservative vector (GitHub Advisory, Red Hat CVE).

The root cause is a size_t integer underflow (CWE-191) leading to a heap-based buffer overflow write (CWE-122) in libfreerdp/codec/dsp.c. Both the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes (4 or 8 bytes for IMA-ADPCM; 7 or 14 bytes for MS-ADPCM) from a size_t variable without first verifying that size is large enough. When the server-controlled nBlockAlign value is crafted such that size % block_size == 0 triggers header parsing when size is smaller than the header, the subtraction wraps size to approximately SIZE_MAX. The subsequent while (size > 0) loop then iterates an astronomical number of times, writing decoded audio samples to the output heap buffer far beyond its allocated bounds. The protocol path is: RDPSND channel → rdpsnd_recv_wave2_pdu() → freerdp_dsp_decode() → freerdp_dsp_decode_ima_adpcm() or freerdp_dsp_decode_ms_adpcm(). A public PoC is included in the advisory itself (GitHub Advisory, Fix Commit).

A malicious RDP server can send a crafted Server Audio Formats PDU with a manipulated nBlockAlign value followed by Wave2 PDUs to trigger the overflow on any connecting FreeRDP client without requiring user interaction or authentication. The heap overflow writes attacker-influenced decoded ADPCM audio data, enabling heap metadata corruption and potential adjacent object overwrite, which can lead to remote code execution. At minimum, the vulnerability guarantees a crash (denial of service) in both debug and release builds; in a worst-case scenario, full client-side code execution is achievable (GitHub Advisory).

A standalone, compilable C proof-of-concept is publicly available within the GitHub Security Advisory itself, demonstrating the crash via AddressSanitizer with only 57 bytes of crafted audio data (GitHub Advisory). As of the time of reporting, there is no evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.028% (0.000280), indicating low current exploitation probability. No threat actor attribution has been reported (Red Hat CVE).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., using a modified FreeRDP server build or a custom implementation) that can send crafted RDPSND channel messages.
2. Craft the Server Audio Formats PDU: Configure the audio format advertisement to use WAVE_FORMAT_DVI_ADPCM (IMA-ADPCM) or WAVE_FORMAT_ADPCM (MS-ADPCM) with a nBlockAlign value chosen so that size % block_size == 0 triggers header parsing when the remaining buffer is smaller than the header (e.g., nBlockAlign = 65 with 2 channels as shown in the PoC).
3. Lure the victim client: Trick a FreeRDP client (version < 3.24.0) into connecting to the malicious server — this requires no user interaction beyond initiating the RDP session, as audio negotiation is automatic.
4. Send crafted Wave2 PDUs: Transmit audio data (e.g., 57 bytes of zeroed or attacker-controlled data) via the RDPSND channel. The client's decoder will process the data, trigger the size_t underflow, and enter the infinite write loop.
5. Achieve heap overflow: Each loop iteration writes 32 bytes of decoded audio samples to the output heap buffer, rapidly overflowing it. This corrupts heap metadata and adjacent objects, leading to a crash (DoS) or, with further heap-grooming, potential remote code execution on the client (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to unknown servers; RDP sessions where the server advertises IMA-ADPCM or MS-ADPCM audio formats with unusual nBlockAlign values.
• Process: FreeRDP client process (xfreerdp, wfreerdp, etc.) crashing or terminating abnormally shortly after establishing an RDP session; crash dumps referencing freerdp_dsp_decode_ima_adpcm or freerdp_dsp_decode_ms_adpcm in the stack trace.
• Logs: Application crash logs or core dumps from FreeRDP processes; AddressSanitizer output referencing codec/dsp.c around line 400 if debug builds are in use.
• File System: Unexpected core dump files (core.*) in the working directory of the FreeRDP client process following an RDP session.

Upgrade FreeRDP to version 3.24.0 or later, which includes the fix (commit 16df230) that adds explicit size checks before each header subtraction in both the IMA-ADPCM and MS-ADPCM decoders (Fix Commit). Red Hat has issued multiple errata addressing this issue across RHEL 7 through 10 (RHSA-2026:16014, 16019, 16482, 16483, 16485, 16777, 16814, 16866, 19358, 19811, 20546, 20605) (Red Hat Bugzilla). As a workaround, disable the RDPSND audio channel in FreeRDP client configurations (/audio-mode:0 or equivalent) if audio redirection is not required, and restrict RDP client connections to trusted, verified servers only.

Red Hat tracked the vulnerability as medium severity in their Bugzilla and issued over a dozen errata across supported RHEL versions (Red Hat Bugzilla). openSUSE, Debian, AlmaLinux, Rocky Linux, Oracle Linux, Amazon Linux, Mageia, and FreeBSD also issued security advisories and package updates. The Cyble weekly vulnerability report for the week of April 8, 2026 highlighted this CVE among notable issues. No significant independent researcher commentary or social media discussion beyond standard vulnerability tracking has been identified.