CVE-2026-63633

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious Remote Desktop Protocol (RDP) server can exploit a heap buffer overflow vulnerability during Opus audio decoding. This occurs when the server negotiates Opus audio with a vulnerable client, causing the client to write data beyond an allocated memory buffer. This can lead to client crashes, memory corruption, and potentially allow the malicious server to execute arbitrary code on the client system.

A heap buffer overflow vulnerability was found in FreeRDP's DSP audio codec module (libfreerdp/codec/dsp.c). When built with WITH_OPUS and without WITH_DSP_FFMPEG, freerdp_dsp_decode_opus fails to validate destination buffer capacity when handling WAVE_FORMAT_OPUS streams. A malicious RDP server can transmit an oversized Opus frame, causing libopus to write beyond the 4096-byte client buffer allocated by the rdpsnd channel. This leads to client heap corruption, application crashes, or potential remote code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, disable audio redirection on client connections by omitting audio parameters (such as /sound or /audio) in xfreerdp to bypass client-side DSP audio decoding.