CVE-2026-63117

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. An authenticated Remote Desktop Protocol (RDP) client can trigger a denial of service by sending a specially crafted DVI ADPCM frame. By advertising specific nBlockAlign and nChannels values, a division-by-zero error occurs in the rdpsnd_server_select_format function. This vulnerability leads to the termination of the server-side rdpsnd channel process, causing a denial of service.

A divide-by-zero flaw was found in FreeRDP's rdpsnd audio channel server implementation. An authenticated remote RDP client can send malformed DVI ADPCM audio parameters (nBlockAlign=8, nChannels=2) during format selection in rdpsnd_server_select_format. This triggers an unhandled SIGFPE signal when calculating audio frames, crashing the server-side rdpsnd process and resulting in a denial of service for remote desktop audio capabilities.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, administrators can disable audio redirection on the FreeRDP server configuration if remote audio support is not strictly required.