CVE-2026-31885: 
NixOS vulnerability analysis and mitigation

CVE-2026-31885 is an out-of-bounds read vulnerability in FreeRDP's MS-ADPCM and IMA-ADPCM audio decoders, caused by missing bounds checks on predictor and step_index values read directly from network input. It affects all FreeRDP versions up to and including 3.23.0, and was disclosed on March 13, 2026, with a fix released in version 3.24.0. The GitHub Security Advisory rates it as Moderate with a CVSS v3.1 score of 6.5, while Feedly's aggregated data reflects a higher score of 9.4 (Critical) based on a different vector assessment (GitHub Advisory, Red Hat CVE).

The vulnerability (CWE-125: Out-of-bounds Read) exists in two locations within libfreerdp/codec/dsp.c. In the MS-ADPCM decoder, a predictor byte read from the wire (range 0–255) is used directly as an index into ms_adpcm_coeffs1[] and ms_adpcm_coeffs2[], which are 7-element arrays (valid indices 0–6); values ≥ 7 cause reads past the array boundary into the .rodata section. In the IMA-ADPCM decoder, a last_step value (range 0–255) from the block header indexes into ima_step_size_table[], which has only 89 entries, and the clamping to valid range occurs after the first table lookup. The attack path follows the RDPSND channel: a malicious RDP server sends a crafted Server Audio Formats PDU (setting WAVE_FORMAT_ADPCM or WAVE_FORMAT_DVI_ADPCM) followed by a Wave2 PDU containing the malicious audio data, triggering freerdp_dsp_decode() with attacker-controlled values (GitHub Advisory, Fix Commit).

Successful exploitation allows an attacker to read out-of-bounds memory from the static data (.rodata) section of the FreeRDP process, potentially leaking sensitive global data such as memory addresses, strings, or other in-process information. A denial-of-service condition (crash) is also possible if the read crosses a page boundary. The vulnerability affects the confidentiality and availability of the FreeRDP client process; integrity impact is assessed as low to none (GitHub Advisory, Red Hat CVE).

A proof-of-concept (PoC) exploit is publicly available in the GitHub Security Advisory, consisting of a complete standalone C program that calls FreeRDP library functions with a malicious predictor value of 200 to trigger the out-of-bounds read, along with compilation instructions using GCC/Clang with AddressSanitizer (GitHub Advisory). There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.031% (0.000310), indicating low probability of exploitation in the near term (Red Hat CVE). Exploitation requires user interaction — a victim must connect to a malicious RDP server — which limits the practical attack surface.

1. Set up a malicious RDP server: Configure a rogue RDP server capable of sending crafted RDPSND channel messages, including a Server Audio Formats PDU advertising WAVE_FORMAT_ADPCM (MS-ADPCM) or WAVE_FORMAT_DVI_ADPCM (IMA-ADPCM) format.
2. Lure the victim to connect: Social-engineer or redirect a target FreeRDP client (version ≤ 3.23.0) to connect to the malicious server, e.g., via a crafted .rdp file or phishing link.
3. Send malicious audio data: Once the client connects and negotiates audio, send a Wave2 PDU containing a crafted audio block where the predictor byte (MS-ADPCM) is set to a value ≥ 7 (e.g., 200) or the step_index byte (IMA-ADPCM) is set to a value ≥ 89.
4. Trigger out-of-bounds read: The FreeRDP client's freerdp_dsp_decode() function processes the malicious block, using the unchecked value as an array index into ms_adpcm_coeffs1[]/ms_adpcm_coeffs2[] or ima_step_size_table[], reading memory beyond the array bounds.
5. Leak or crash: The OOB read returns data from adjacent .rodata memory (information disclosure) or, if the read crosses a page boundary, causes a segmentation fault (denial of service) (GitHub Advisory).

• Network: Unexpected or unsolicited RDP connections to unknown servers; RDPSND channel traffic containing audio format negotiation for ADPCM formats followed by anomalous Wave2 PDUs with out-of-range header bytes.
• Process: FreeRDP client process (xfreerdp, wfreerdp) crashing with a segmentation fault or SIGBUS signal during an active RDP session, particularly during audio playback.
• Logs: Core dump files generated by the FreeRDP process; system logs (e.g., /var/log/syslog, journald) showing FreeRDP process termination with signal 11 (SIGSEGV) or signal 7 (SIGBUS).
• File System: Presence of core dump files (e.g., core, core.<pid>) in the working directory of the FreeRDP process, potentially containing leaked memory contents.

The primary remediation is to upgrade FreeRDP to version 3.24.0 or later, which adds proper bounds checks on predictor and step_index values before array indexing in both the MS-ADPCM and IMA-ADPCM decoders (Fix Commit, GitHub Advisory). Red Hat has issued multiple errata addressing this CVE across RHEL 7 through RHEL 10, including RHSA-2026:16014 (RHEL 10), RHSA-2026:16019 (RHEL 8), RHSA-2026:16482 (RHEL 9), and several extended support variants (Red Hat Bugzilla). As a workaround, organizations can disable audio redirection in RDP sessions or restrict FreeRDP clients from connecting to untrusted RDP servers until patching is complete.

The vulnerability was reported by researcher YJK0805 and published by FreeRDP maintainer akallabeth via GitHub Security Advisories on March 13, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla and issued numerous errata across supported RHEL versions, indicating broad downstream impact for enterprise Linux users (Red Hat Bugzilla). OpenSUSE, Fedora, Debian, AlmaLinux, Rocky Linux, Amazon Linux, and Mageia also issued security advisories and package updates, reflecting wide adoption of FreeRDP across Linux distributions.