CVE-2026-31884: 
NixOS vulnerability analysis and mitigation

CVE-2026-31884 is a divide-by-zero vulnerability in FreeRDP's MS-ADPCM and IMA-ADPCM audio decoders that allows a malicious RDP server to crash the FreeRDP client by sending a Server Audio Formats PDU with nBlockAlign set to 0. All FreeRDP versions prior to 3.24.0 are affected. The vulnerability was disclosed on March 13, 2026, by researcher YJK0805 via the FreeRDP GitHub Security Advisory. It carries a CVSS v3.1 base score of 6.5 (Medium) per the official advisory, though some sources report 7.5 (High) due to differing assessments of user interaction requirements (FreeRDP Advisory, Red Hat Bugzilla).

The root cause is a missing input validation flaw (CWE-369: Divide By Zero) in libfreerdp/codec/dsp.c. Both the MS-ADPCM decoder (freerdp_dsp_decode_ms_adpcm) and IMA-ADPCM decoder (freerdp_dsp_decode_ima_adpcm) compute size % block_size where block_size = context->common.format.nBlockAlign. The nBlockAlign value is received directly from the Server Audio Formats PDU over the RDPSND channel and is never validated before reaching the decoder; when it equals 0, the modulo operation triggers a SIGFPE (floating point exception) crash. The attack path is: RDPSND channel → Server Audio Formats PDU (sets nBlockAlign = 0) → Wave2 PDU → freerdp_dsp_decode() → crash. A public proof-of-concept demonstrating the crash is included in the official security advisory (FreeRDP Advisory, Patch Commit).

Successful exploitation results in a denial-of-service condition — the FreeRDP client process crashes with a SIGFPE signal. There is no impact on confidentiality or integrity; only availability is affected. The crash is triggered remotely by a malicious or compromised RDP server after the client establishes a connection, requiring user interaction to initiate the RDP session but no special privileges on the attacker's side (FreeRDP Advisory).

A public proof-of-concept (PoC) C program is available in the official FreeRDP security advisory, demonstrating the crash with AddressSanitizer/UBSan output. There is no evidence of in-the-wild exploitation or threat actor attribution at this time. The EPSS score is approximately 0.032% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (FreeRDP Advisory, Feedly).

1. Set up a malicious RDP server: Configure or modify an RDP server implementation to send a crafted Server Audio Formats PDU on the RDPSND virtual channel with the nBlockAlign field set to 0 for an ADPCM audio format (WAVE_FORMAT_ADPCM or WAVE_FORMAT_DVI_ADPCM).
2. Lure the victim to connect: Social-engineer or redirect a target user running a vulnerable FreeRDP client (version ≤ 3.23.0) to connect to the attacker-controlled RDP server.
3. Trigger audio format negotiation: Once the client connects, the server sends the malicious Server Audio Formats PDU during the RDPSND channel handshake, advertising an ADPCM format with nBlockAlign = 0.
4. Send audio data: The server sends a Wave2 PDU containing audio data, causing the client to invoke freerdp_dsp_decode(), which calls the ADPCM decoder and executes size % block_size with block_size = 0.
5. Client crashes: The modulo-by-zero operation raises a SIGFPE signal, crashing the FreeRDP client process and achieving denial of service (FreeRDP Advisory).

• Process: Unexpected termination of the xfreerdp or wfreerdp process with a SIGFPE (signal 8) exit code; crash dumps referencing freerdp_dsp_decode_ms_adpcm or freerdp_dsp_decode_ima_adpcm in libfreerdp/codec/dsp.c.
• Logs: System logs (e.g., /var/log/syslog, journald) showing FreeRDP process killed by SIGFPE; application crash reports with stack traces pointing to dsp.c:933 or similar lines in the ADPCM decoder.
• Network: RDP connections (TCP port 3389) to unfamiliar or external IP addresses followed immediately by client-side process termination; RDPSND channel traffic containing audio format PDUs with anomalous nBlockAlign = 0 values (detectable via deep packet inspection or RDP-aware IDS signatures).

The primary remediation is to upgrade FreeRDP to version 3.24.0 or later, which adds valid_ms_adpcm_format() and valid_ima_adpcm_format() validation functions that reject nBlockAlign values of 0 or less than 4 before any decoder operation (Patch Commit, FreeRDP Advisory). Red Hat has issued multiple errata addressing this CVE across RHEL 7 through 10 (RHSA-2026:16014, RHSA-2026:16019, RHSA-2026:16482 through RHSA-2026:20605); users of affected RHEL versions should apply the relevant errata (Red Hat Bugzilla). As a workaround where patching is not immediately possible, restrict FreeRDP client connections to trusted RDP servers only and consider disabling audio redirection via the /audio-mode:2 flag or equivalent configuration to prevent the RDPSND channel from being negotiated.

The vulnerability was reported by researcher YJK0805 and acknowledged by the FreeRDP maintainer (akallabeth) via GitHub Security Advisory. Red Hat tracked the issue in Bugzilla and issued numerous errata across multiple RHEL versions, indicating broad downstream impact. openSUSE, Debian, Amazon Linux, and Fedora also issued security updates addressing this CVE, reflecting standard coordinated disclosure and patch propagation across major Linux distributions (Red Hat Bugzilla, FreeRDP Advisory).