FreeRDP CVE-2026-63633

Two compile-time build flags must both be set in the FreeRDP binary: WITH_OPUS must be ON (enabling libopus integration) and WITH_DSP_FFMPEG must be OFF (disabling the FFmpeg audio decode path). These are build-time conditions baked into the binary at package creation - a runtime configuration check cannot substitute for verifying the build flags used. At runtime, the RDP server must successfully negotiate WAVE_FORMAT_OPUS for the rdpsnd audio channel; since the attacker controls the server, format negotiation is fully under attacker control. The attacker requires no authentication or credentials - they operate as the server. Passive user interaction is required: the victim must initiate an RDP connection to the attacker's server, either directly or through social engineering. Exploitation is impossible against clients built with WITH_OPUS=OFF (no Opus code path exists) or WITH_DSP_FFMPEG=ON (a separate decode path is used); these build combinations are the primary limiting factor reducing the realistic exploitable population.

The CVSS 4.0 score of 7.7 (High) with vector AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N is broadly consistent with the description: the attack is network-reachable with low complexity once the build-time prerequisites are met, and the CIA impact on the vulnerable client system is fully High. AT:P correctly models that specific compile-time build flags (WITH_OPUS=ON, WITH_DSP_FFMPEG=OFF) must be present in the target binary - a condition outside the attacker's control - which meaningfully narrows the exploitable population relative to a raw AV:N/AC:L score would suggest. The vulnerability is not listed in the CISA KEV catalog and no POC is identified, reducing immediate threat urgency. EPSS data was not provided; given the build prerequisite and the requirement for passive user interaction (victim must connect to attacker's server), opportunistic mass exploitation is unlikely. However, a targeted attacker with knowledge of a client build's Opus support - plausible in enterprise or developer environments - could achieve heap corruption with realistic social engineering. The RCE tag should be treated as a credible ceiling: heap overflows in audio decoders have a well-documented history of weaponization, and this primitive (controlled write beyond a known-sized buffer) is favorable for exploitation.

An attacker hosts a rogue RDP server and lures a target into connecting - via a phishing email containing a malicious .rdp shortcut, a compromised internal redirect, or a social-engineering pretext. Upon connection, the server advertises and enforces WAVE_FORMAT_OPUS for the rdpsnd audio channel, then transmits a crafted Opus audio packet that decodes to a PCM payload substantially larger than 4096 bytes, overwriting heap memory adjacent to the StreamPool_Take buffer on the client and potentially redirecting execution to attacker-controlled shellcode.