The vulnerability is located in the IMA ADPCM audio decoder used by the FreeRDP client. When a Remote Desktop Protocol server sends audio data that contains an invalid initial step index value of 89 or greater, the decoder reads this value directly from the network and uses it to index into a fixed 89-entry lookup table. Because the value is not validated, a lookup beyond the bounds of the table triggers a WINPR_ASSERT failure, which causes the client process to abort with a SIGABRT signal. This results in a denial of service for the affected client, interrupting remote desktop sessions.

All installations of FreeRDP that have audio redirection (RDPSND) enabled are vulnerable. Audio redirection is enabled by default, so any FreeRDP client running a version earlier than 3.24.2 will crash when it receives a specially crafted IMA ADPCM audio packet from a malicious RDP server. The flaw applies to all platforms that run FreeRDP, regardless of operating system.

The CVSS score of 6.9 indicates a moderate severity. The vulnerability is network accessible, as it requires only a RDP server that can send crafted audio data to the client. While the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, a remote attacker who controls the server can force the client to crash by sending an audio packet with an out‑of‑range step index. The impact is limited to service disruption for the affected client; there is no direct impact on the remote server or on data confidentiality or integrity.