FreeRDP versions 2.0.0 through 3.31.x contain a heap‑based buffer overflow in the function that decodes MP3 audio when the client is built with LAME support and without the FFMPEG DSP module. An attacker controlling the RDP server can send specially crafted MP3 data over the rdpsnd channel. During decoding, the right‑channel PCM pointer is mis‑offset, causing the decoder to write past the allocated heap buffer and crash the client. The primary consequence is a denial of service that prevents the user from maintaining a remote session.

The flaw affects FreeRDP, the remote‑desktop protocol client, in all releases from 2.0.0 up to, but not including, 3.32.0 that are configured with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF. These builds are typically used on systems where MP3 audio support is enabled via the LAME library and the FFMPEG DSP alternative is disabled.

The vulnerability has a CVSS score of 6.1, indicating moderate severity. No EPSS score is available, and the issue is not listed in the KEV catalog, suggesting that exploitation in the wild has not yet been observed. Attackers can trigger the overflow remotely by acting as an RDP server that sends malicious audio over the rdpsnd stream. Because the overflowing write occurs on the client’s heap, it can lead to a crash, and the description indicates only a denial of service. The risk remains limited to a denial of service for now.