DEBIAN-CVE-2026-31883

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-31883
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31883.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-31883
Upstream
Published
2026-03-13T19:54:37Z
Modified
2026-09-14T17:03:06Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, a size_t underflow in the IMA-ADPCM and MS-ADPCM audio decoders leads to heap-buffer-overflow write via the RDPSND audio channel. In libfreerdp/codec/dsp.c, the IMA-ADPCM and MS-ADPCM decoders subtract block header sizes from a size_t variable without checking for underflow. When nBlockAlign (received from the server) is set such that size % block_size == 0 triggers the header parsing at a point where size is smaller than the header (4 or 8 bytes), the subtraction wraps size to ~SIZE_MAX. The while (size > 0) loop then continues for an astronomical number of iterations. This vulnerability is fixed in 3.24.0.

References

Affected packages

Debian:12 / freerdp2

Package

Name
freerdp2
Purl
pkg:deb/debian/freerdp2?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

2.*
2.10.0+dfsg1-1
2.10.0+dfsg1-1.1
2.11.2+dfsg1-1
2.11.2+dfsg1-1.1~exp1
2.11.2+dfsg1-1.1~exp2
2.11.5+dfsg1-1
2.11.7+dfsg1-1
2.11.7+dfsg1-2
2.11.7+dfsg1-3
2.11.7+dfsg1-4
2.11.7+dfsg1-5
2.11.7+dfsg1-6~deb12u1
2.11.7+dfsg1-6

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31883.json"

Debian:13 / freerdp3

Package

Name
freerdp3
Purl
pkg:deb/debian/freerdp3?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.15.0+dfsg-2.1+deb13u2

Affected versions

3.*
3.15.0+dfsg-2.1
3.15.0+dfsg-2.1+deb13u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31883.json"

Debian:14 / freerdp3

Package

Name
freerdp3
Purl
pkg:deb/debian/freerdp3?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.24.0+dfsg-1

Affected versions

3.*
3.15.0+dfsg-2.1
3.16.0+dfsg-1
3.16.0+dfsg-2
3.17.0+dfsg-1
3.17.1+dfsg-1
3.17.1+dfsg-2
3.17.2+dfsg-1
3.17.2+dfsg-2
3.17.2+dfsg-3
3.18.0+dfsg-1
3.19.0+dfsg-1
3.19.1+dfsg-1
3.20.0+dfsg-1
3.20.2+dfsg-1
3.21.0+dfsg-1
3.22.0+dfsg-1~bpo13+0
3.22.0+dfsg-1~bpo13+1
3.22.0+dfsg-1
3.22.0+dfsg-3
3.23.0+dfsg-1~bpo13+1
3.23.0+dfsg-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-31883.json"