FreeRDP CVE-2026-114045

Requires a FreeRDP-based RDP *server* (version before 3.32.1) that enables the server-side rdpsnd (audio redirection) virtual channel, and the attacker must act as the connecting RDP client and reach the server audio-playback path. The specific trigger is sending two SNDC_FORMATS PDUs whose nBlockAlign is too small relative to nChannels, causing integer wraparound in DVI_ADPCM block-alignment validation. Limiting factors: the PR:L metric means a session/channel negotiation foothold is needed (not purely anonymous drive-by), exploitation only applies to deployments running FreeRDP in server mode with rdpsnd active, and reliable code execution (versus a crash) is not confirmed.

This is a credible, high-priority memory-corruption flaw rather than an inflated high-CVSS issue, though not the highest tier of urgency. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H/VA:H and base score 8.7 indicates network-reachable exploitation at low complexity with no user interaction, and the triple-high vulnerable-system impact is consistent with the described heap-based buffer overflow that 'potentially' enables code execution on the RDP server. The PR:L metric is the single most important mitigating signal: exploitation is not fully unauthenticated - a malicious client must establish enough of an RDP session to negotiate the rdpsnd virtual channel and reach server-side audio playback, so this is primarily a threat where untrusted or semi-trusted clients can connect to a FreeRDP-based server. No EPSS score, CISA KEV entry, SSVC decision data, or public POC was provided in the input; accordingly there is no public exploit identified at time of analysis and no evidence of active exploitation, which lowers immediate real-world urgency relative to the theoretical impact. The signals are internally consistent (network vector matches the RDP-client-to-server description), so there is no CVSS-vs-description conflict to flag; the main caveat is that RCE is described as 'potentially' achievable, meaning weaponization difficulty is unverified and impact could in practice be limited to a denial of service.

An attacker connects to an exposed or reachable FreeRDP-based server, completes enough session negotiation to open the rdpsnd audio channel, and sends two crafted SNDC_FORMATS PDUs specifying an nBlockAlign too small for the declared nChannels. The resulting integer wraparound bypasses block-alignment validation and causes an unbounded heap write during server audio playback, corrupting memory and potentially leading to remote code execution in the server process. No public proof-of-concept exploit was identified in the provided data.