FreeRDP, a free implementation of the Remote Desktop Protocol, suffered a heap buffer overflow in the Opus audio decoding routine. The bug occurs when a server negotiates the WAVE_FORMAT_OPUS audio codec with a client that has had Opus support compiled in but the FFmpeg DSP layer disabled. The vulnerable function writes decoded PCM data into a buffer without properly checking that the destination stream is large enough, allowing a crafted large frame to overflow a 4096‑byte stream buffer. The overflow corrupts the client heap, causing a crash and potentially enabling arbitrary code execution on the client side.

All versions of FreeRDP earlier than 3.28.0 are affected. The fix was introduced in the 3.28.0 release, which corrects the buffer‑sizing logic in freerdp_dsp_decode_opus. Administrators should verify whether their installations use any of the vulnerable build options: WITH_OPUS enabled and WITH_DSP_FFMPEG disabled.

The CVSS score is 7.7, indicating high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified, but the lack of presence in the CISA KEV catalog suggests there are no known widespread attacks. The attack vector is server‑to‑client; a malicious RDP server can trigger the overflow by sending a large Opus frame. The vulnerability requires that the client support Opus and that the server negotiate it, so denial of service or remote code execution is only possible if those conditions are met.