Medium severity6.5NVD Advisory· Published Mar 30, 2026· Updated Apr 1, 2026
CVE-2026-33977
CVE-2026-33977
Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
Affected products
1Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
2- github.com/FreeRDP/FreeRDP/commit/9be3f03d94a50892fd58a9f7dee72b2313c69b47nvdPatch
- github.com/FreeRDP/FreeRDP/security/advisories/GHSA-8f2g-3q27-6xm5nvdExploitMitigationPatchVendor Advisory
News mentions
0No linked articles in our index yet.