The vulnerability resides in the MS‑ADPCM and IMA‑ADPCM decoders of FreeRDP prior to version 3.24.0. It allows a decoder to read memory beyond the bounds of the input buffer because the predictor and step_index values extracted from the audio stream are not validated. Based on the description, it is inferred that this could expose internal memory contents to an attacker, which may be a precursor to more severe attacks.

All installations of FreeRDP with a release earlier than 3.24.0 are affected. The issue was fixed in release 3.24.0; any deployment using an older version must be updated.

The CVSS score of 6.5 indicates medium severity. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, which implies a low likelihood of widespread exploitation. An attacker would need to supply malicious RDP audio data to the vulnerable client or server, implying a remote attack vector that requires the ability to influence the decoding process.