Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0.
Published: 2026-02-09
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution via Heap Buffer Overflow
Action: Apply Patch
AI Analysis

Impact

FreeRDP contains a heap‑buffer‑overflow in the function audio_formats_free, triggered when an audio format parse fails. The incorrect deallocation size leads to out‑of‑bounds memory access, potentially corrupting the heap and allowing an attacker to execute arbitrary code on the server.

Affected Systems

Versions of FreeRDP older than 3.22.0 are affected. The vulnerability exists in all builds of the FreeRDP project released before that fix, regardless of platform.

Risk and Exploitability

The vulnerability scores a CVSS score of 8.7, indicating a high‑severity flaw. EPSS indicates a very low likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Nonetheless, the attack vector is likely remote: a malicious Remote Desktop client can send crafted audio format data to trigger the overflow on the server side. Proper patching eliminates this risk.

Generated by OpenCVE AI on April 18, 2026 at 13:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade to FreeRDP version 3.22.0 or later to remove the vulnerable code.
  • If an immediate upgrade is not possible, disable the RDP audio channel in server configuration to prevent the vulnerable code path from being exercised.
  • Restrict RDP access to trusted hosts and monitor for anomalous connection attempts to reduce the attack surface.

Generated by OpenCVE AI on April 18, 2026 at 13:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8042-1 FreeRDP vulnerabilities
History

Tue, 10 Feb 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 10 Feb 2026 15:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Tue, 10 Feb 2026 12:45:00 +0000

Type Values Removed Values Added
First Time appeared Freerdp
Freerdp freerdp
Vendors & Products Freerdp
Freerdp freerdp

Tue, 10 Feb 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-131
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}

threat_severity

Moderate

Mon, 09 Feb 2026 18:45:00 +0000

Type Values Removed Values Added
Description FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free. This vulnerability is fixed in 3.22.0.
Title FreeRDP has a Heap-buffer-overflow in audio_formats_free
Weaknesses CWE-122
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-02-10T16:01:54.846Z

Reserved: 2026-01-23T20:40:23.389Z

Link: CVE-2026-24682

cve-icon Vulnrichment

Updated: 2026-02-10T15:40:00.509Z

cve-icon NVD

Status : Analyzed

Published: 2026-02-09T19:15:49.763

Modified: 2026-02-10T15:04:10.197

Link: CVE-2026-24682

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-02-09T18:21:39Z

Links: CVE-2026-24682 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-04-18T13:15:25Z

Weaknesses