FreeRDP EUVD-2026-115919

Exploitation requires a specific, narrow stack: the victim must initiate an RDP connection to a malicious or compromised server (UI:P/UI:R), audio playback must be enabled so the rdpsnd static channel is loaded, and FreeRDP must be built with WITH_GSM=ON and WITH_DSP_FFMPEG=OFF so the built-in libgsm WAV49 decoder is used instead of the preferred FFmpeg DSP backend. The attacking server must offer GSM610 on rdpsnd and send a WAVE2 message whose audio body (after the 12-byte header) is shorter than the next complete WAV49 frame (33- or 32-byte boundary); the channel totalLength and WAVE2 BodySize can remain fully consistent because the missing check is at the codec-frame boundary. Limiting factors that reduce real-world risk: GSM is an optional build feature and many builds prefer the FFmpeg DSP backend (which is not vulnerable here), user interaction to connect is mandatory, audio must be active, and the impact is confined to a client-side crash with no claimed write, code execution, confidentiality, or integrity loss.

Signals are mostly consistent and point to a medium-severity, availability-only client-side issue rather than an urgent priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, VA:L, 5.3) and the GHSA provisional CVSS 3.1 (AV:N/AC:L/PR:N/UI:R/S:U/A:H, 6.5) agree that this is network-reachable, low-complexity, and requires victim interaction, but they disagree on availability magnitude (4.0 rates VA:L while the GHSA rates A:H) - the demonstrated effect is a full client-process SIGSEGV, which argues for the higher availability rating. No KEV listing is present, so this is not confirmed actively exploited, and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the input. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a non-critical DoS. The advisory ships a bounded guard-page verifier that demonstrates the crash locally; this is a public PoC reference, not a verified working remote exploit, and it should not be conflated with active exploitation. Most importantly, exploitation is gated by a narrow build configuration (WITH_GSM=ON and WITH_DSP_FFMPEG=OFF), the user initiating a connection to a malicious server, and audio being enabled - so real-world exposure is limited despite the network attack vector. Net: a legitimate but low-to-medium real-world priority, not a high-urgency item.

A user is lured into connecting their FreeRDP-based client to an attacker-controlled or compromised RDP server with audio playback enabled. The malicious server negotiates the GSM610 codec on the rdpsnd channel and sends a length-consistent WAVE2 message whose audio body is one byte short of a complete 32-byte WAV49 frame, causing the built-in decoder to read past the buffer and crash the client (SIGSEGV). A public PoC reference exists in the GHSA advisory (a bounded guard-page verifier); it is not verified as working remote exploit code.