The FreeRDP client crashes when a malicious RDP server sends audio data in IMA ADPCM format with an invalid initial step index value (greater than or equal to 89). The unvalidated step index is used directly as an index into a 89‑element lookup table, causing a WINPR_ASSERT failure that aborts the client process. This results in a denial of service for users relying on the client.

All FreeRDP clients affected by this vulnerability run versions older than 3.24.2 and have audio redirection (RDPSND) enabled, which is the default configuration. The affected product is listed as FreeRDP:FreeRDP.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation worldwide. The flaw is not included in the CISA KEV catalog. An attacker who can control an RDP server to which a client connects can trigger the crash by sending a malformed IMA ADPCM audio packet during the session. Because the crash terminates only the client process, the attack does not enable further privilege escalation or data theft, but it effectively disrupts the user’s remote desktop session.