CVE-2026-33977: 
NixOS vulnerability analysis and mitigation

CVE-2026-33977 is a Denial of Service vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting all versions prior to 3.24.2. A malicious RDP server can crash the FreeRDP client by sending IMA ADPCM audio data with an invalid initial step index value (>= 89), triggering a WINPR_ASSERT() failure and process abort via SIGABRT. The vulnerability was published on March 30, 2026, and patched in version 3.24.2. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-617 (Reachable Assertion) and CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input). In libfreerdp/codec/dsp.c, the function freerdp_dsp_decode_ima_adpcm() reads the initial IMA ADPCM step index directly from the server's RDPSND audio payload at lines 405 and 416 without prior validation: context->adpcm.ima.last_step[0] = (INT16)(*(src + 2));. This value (range 0–255) is then passed to dsp_decode_ima_adpcm_sample(), where WINPR_ASSERT(WINPR_CXX_COMPAT_CAST(size_t, offset) < ARRAYSIZE(ima_step_size_table)) fires at line 331 if the index is >= 89 (the table has exactly 89 entries), calling abort() and crashing the client. A clamping check does exist in the code but only executes after the first sample decode — too late to prevent the assertion failure on the initial unclamped value from the network (GitHub Advisory, Patch Commit).

Successful exploitation results in an immediate crash (SIGABRT) of the FreeRDP client process, causing a complete loss of availability for the affected session. There is no confidentiality or integrity impact — the vulnerability is purely a Denial of Service. All FreeRDP-based clients (xfreerdp, SDL client, and any third-party application using libfreerdp) that connect to a malicious RDP server with audio redirection (RDPSND) enabled are affected; since RDPSND is enabled by default, the attack surface is broad (GitHub Advisory).

A proof-of-concept (PoC) exploit in C (poc_adpcm.c) is publicly available in the GitHub security advisory, with complete compilation and execution instructions demonstrating the crash (GitHub Advisory). The vulnerability requires user interaction — the victim must connect to a malicious RDP server — but no privileges are required on the attacker's side. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.042%, indicating low probability of exploitation in the near term (Feedly). The vulnerability is not listed in the CISA KEV catalog.

1. Set up a malicious RDP server: The attacker configures a rogue RDP server (e.g., using a custom implementation or modified FreeRDP server) that advertises support for the RDPSND (audio redirection) channel.
2. Lure the victim to connect: The attacker tricks a user running a vulnerable FreeRDP client (version <= 3.24.1) into connecting to the malicious server, for example via a phishing link or a man-in-the-middle scenario.
3. Negotiate RDPSND channel: During the RDP session setup, the server negotiates the RDPSND audio redirection channel, which is accepted by default in FreeRDP client configurations.
4. Send crafted IMA ADPCM audio block: The server sends an RDPSND audio payload in IMA ADPCM format where the step index byte (at offset +2 in the block header) is set to a value >= 89 (e.g., 200). This value is read directly into context->adpcm.ima.last_step[0] without validation.
5. Trigger WINPR_ASSERT failure: When the client attempts to decode the first audio sample, dsp_decode_ima_adpcm_sample() evaluates WINPR_ASSERT((size_t)offset < 89) with offset=200, which fails, calling abort() and terminating the client process via SIGABRT (GitHub Advisory).

• Process: Unexpected termination of the FreeRDP client process (xfreerdp, sdl-freerdp, or libfreerdp-based app) with a SIGABRT signal; crash dumps or core files generated by the FreeRDP process.
• Logs: System logs (e.g., /var/log/syslog, journald) showing entries like [FATAL][com.freerdp.winpr.assert] - [winpr_int_assert]: Assertion failed followed by process abort; application crash reports referencing dsp.c:331.
• Network: Outbound RDP connections (TCP port 3389) to unfamiliar or untrusted IP addresses, particularly if followed immediately by connection termination; repeated connection attempts to the same suspicious server.

Upgrade FreeRDP to version 3.24.2 or later, which introduces a dsp_ima_clamp_step() function that validates and clamps the step index immediately after reading it from the network, before any assertion is evaluated (Patch Commit). As a workaround for users who cannot immediately upgrade, disable audio redirection (RDPSND) when connecting to RDP servers by passing the /audio-mode:2 or equivalent flag to suppress the RDPSND channel. Users should also exercise caution when connecting to untrusted or unknown RDP servers, as exploitation requires the client to initiate a connection to a malicious server (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (Bug 2453224) and assigned it medium severity, reflecting the limited impact scope (DoS only, requires user interaction) (Red Hat Bugzilla). The vulnerability was reported by a researcher identified as "Sebasteuo" and acknowledged by FreeRDP maintainer akallabeth, who published the advisory and patch promptly (GitHub Advisory). Downstream Linux distributions including Fedora, openSUSE, Amazon Linux 2/2023, and Debian have issued security updates incorporating the fix.