EUVD-2026-62672Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects compile-time build prerequisites outside attacker control (WITH_OPUS=ON, WITH_DSP_FFMPEG=OFF); UI:R because victim must actively initiate the RDP connection to the attacker's server.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
4DescriptionCVE.org
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.
AnalysisAI
Heap buffer overflow in FreeRDP's Opus audio codec path allows a malicious RDP server to corrupt client heap memory and potentially execute arbitrary code on any connecting client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. The flaw in freerdp_dsp_decode_opus (versions prior to 3.28.0) stems from a capacity check applied to the wrong buffer, leaving the actual PCM output buffer unguarded against oversized libopus decoded frames that can overrun the fixed 4096-byte StreamPool_Take destination in the rdpsnd channel. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Two compile-time build flags must both be set in the FreeRDP binary: WITH_OPUS must be ON (enabling libopus integration) and WITH_DSP_FFMPEG must be OFF (disabling the FFmpeg audio decode path). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 7.7 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N is broadly consistent with the description: the attack is network-reachable with low complexity once the build-time prerequisites are met, and the CIA impact on the vulnerable client system is fully High. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade FreeRDP to version 3.28.0 or later; this release contains the fix confirmed by commit 0ed1f95d36913581cf31124f94eb5843d4263eae (https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae) and PR #12993 (https://github.com/FreeRDP/FreeRDP/pull/12993), tagged at https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all FreeRDP deployments and identify systems with Opus audio codec enabled (built with WITH_OPUS and WITHOUT WITH_DSP_FFMPEG), prioritizing those connecting to external or non-managed RDP servers. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-122 – Heap-based Buffer Overflow
View allVendor StatusVendor
SUSE
| Product | Status |
|---|---|
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today