FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in…
FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Microsoft
- Product
- Remote Desktop
- CVSS
- 8.8
- EPSS
- 0.006 (p47)
- Exposure class
- Remote access
Why it ranks 28 (Notable)
- CVSS 8.8 high
- Exposed product class: remote access
- Widely deployed vendor product (Microsoft)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.