Freerdp EUVD-2026-12061

CVSS 6.5 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N indicates network-accessible exploitation with low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact. The network attack vector (AV:N) and lack of authentication requirements (PR:N) are concerning for widespread exploitation. However, the impact is limited to low confidentiality and integrity impact with no availability impact (A:N), suggesting the vulnerability causes data corruption or leakage rather than crashes. Without EPSS data provided, the real-world exploitation probability cannot be quantified precisely, but the combination of network accessibility, ease of exploitation, and the fact that audio codecs are commonly used in RDP sessions suggests moderate real-world risk. The lack of documented active exploitation (no KEV status provided) and the specific technical trigger (requiring crafted nBlockAlign values) may reduce immediate prevalence, but the vulnerability is straightforward to exploit programmatically by a malicious RDP server or through man-in-the-middle attack. POC availability via the GitHub commit reference (16df2300e1e3f5a51f68fb1626429e58b531b7c8) enables security researchers to understand the fix mechanism, which may accelerate exploit development.

An attacker controlling or intercepting a Remote Desktop Protocol connection (acting as a malicious RDP server or via man-in-the-middle attack) crafts a specially-formed RDPSND audio packet with a nBlockAlign value designed to trigger the underflow condition in the audio decoder. When the FreeRDP client processes the RDPSND channel data, the vulnerable code path is triggered: the decoder receives encoded audio data, attempts to parse the frame header, and the size calculation underflows, causing size to wrap to ~SIZE_MAX. The while (size > 0) loop then executes trillions of iterations, writing audio sample data beyond the bounds of the allocated heap buffer. This corrupts adjacent heap structures (potentially affecting other audio buffers, session state, or client credentials) and may leak sensitive information from memory. The attack requires network access to the RDP session (AV:N, AC:L, PR:N, UI:N) but does not require social engineering, making it practical for attackers in network-privileged positions. A functional POC demonstrating the underflow and heap corruption can be derived from analysis of the fix commit, enabling reproducible exploitation.