The vulnerability is a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders of FreeRDP, which results in a heap buffer overflow when audio data is received over the RDPSND channel. The underflow occurs during block header parsing when the size value becomes smaller than the header size, causing the subtraction to wrap around to a very large value. The loop then iterates an astronomical number of times, writing beyond the intended buffer. This heap corruption can lead to memory corruption, application crashes, or, in the worst case, arbitrary code execution, compromising confidentiality, integrity, and availability of the system.

The flaw affects all FreeRDP releases prior to version 3.24.0. The affected product is FreeRDP (cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*). Any deployment of these older releases that processes audio streams via the RDPSND channel is vulnerable.

The CVSS score is 6.5, indicating a medium severity. EPSS is below 1%, suggesting exploit likelihood is low, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a Remote Desktop Protocol session where the server sends crafted audio data over the RDPSND channel; the attacker can trigger the buffer overflow by manipulating the block alignment parameter. While the current exploit probability is low, vulnerable systems remain at risk of denial of service or potential code execution under suitable conditions.