CVE-2026-110837

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit this vulnerability by sending specially crafted MP3 audio data to a connected client. Due to an incorrect buffer size calculation during audio decoding, decoded audio data can be written beyond allocated memory limits, resulting in a heap-based buffer overflow. This flaw allows an attacker to crash the client application, leading to a Denial of Service (DoS).

This flaw is rated Important because crafted MP3 audio from a malicious RDP server can cause a heap buffer overflow in the client after the user connects (UI:R), with integrity and availability impact and limited confidentiality impact (CVSS 7.1). Decode-path constraints keep Attack Complexity High. Allocator hardening may impede exploitation but does not clear I:H/A:H.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If audio redirection is unused, disable it. Restrict FreeRDP clients to trusted servers.