FreeRDP versions prior to 3.32.1 contain a heap-based buffer overflow in the server‑side rdpsnd channel caused by an integer wraparound in the rdpsnd_server_select_format() routine. The wraparound bypasses validation of DVI_ADPCM block‑alignment arithmetic, allowing a malicious RDP client to send two SNDC_FORMATS PDUs with an nBlockAlign value smaller than the product of nChannels. This condition results in an unbounded heap write during server audio playback, potentially granting the attacker arbitrary code execution on the RDP server.

The vulnerability affects FreeRDP (FreeRDP) installations older than version 3.32.1, as identified by the vendor and product listing in the advisory.

The CVSS score of 8.7 indicates a high severity issue. The EPSS score of < 1% suggests that exploit activity has been very limited to date, and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the flaw by remotely connecting as an RDP client to a vulnerable FreeRDP server and sending crafted SNDC_FORMATS PDUs. The required conditions are limited to an active RDP session with the rdpsnd channel enabled, making the attack vector network‑based and remote.