CVE-2026-114045
HIGH 8.7FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer wraparound in rdpsnd_server_select_format() DVI_ADPCM block-alignment arithmetic bypasses validation. A malicious RDP client can send two SNDC_FORMATS PDUs with an nBlockAlign too small for nChannels, causing an unbounded heap write during server audio playback, potentially enabling code execution.
ELEVATED IMPACT
Severe if exploited (CVSS 8.7), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 47th percentile
○ In CISA KEV
○ Catalogued PoC
Impact if exploited
8.7CVSS 4.0 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ✓Requirements: No special attack requirements
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-122: Heap-based Buffer Overflow
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References and research data (JSON)
Vendor product assessments
freerdp as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-libs as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-libs
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-server as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-server
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp.src as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp?arch=src
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr-devel as a component of Red Hat Enterprise Linux 10 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- no fix planned: Out of support scope
freerdp-devel as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- no fix planned: Out of support scope
freerdp-libs as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-libs
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- no fix planned: Out of support scope
freerdp-plugins as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-plugins
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- no fix planned: Out of support scope
freerdp.src as a component of Red Hat Enterprise Linux 6 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp?arch=src
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- no fix planned: Out of support scope
freerdp as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-devel as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-libs as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-libs
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-plugins as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-plugins
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp.src as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp?arch=src
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr-devel as a component of Red Hat Enterprise Linux 7 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-libs as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-libs
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp.src as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp?arch=src
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr-devel as a component of Red Hat Enterprise Linux 8 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp-libs as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp-libs
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
freerdp.src as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/freerdp?arch=src
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
libwinpr-devel as a component of Red Hat Enterprise Linux 9 · known affected
Vendor assessment for this product only.
pkg:rpm/redhat/libwinpr-devel
- workaround: If FreeRDP server or shadow components are unused, remove or disable them. Restrict RDP server access to trusted authenticated clients only. Disable server-side audio redirection / rdpsnd when audio playback to clients is not required.
- none available: Affected
All CVSS metrics
- HIGH 8.7 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - HIGH 8.8 v3.1 · CNA Primary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 8.7 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - HIGH 8.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq CVE record · VulnCheck · Updated 2026-10-21T00:36:24.094Z
NVD · CVE-2026-114045 · Updated 2026-10-22T15:44:59.783
Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00 - https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format CVE record · VulnCheck · Updated 2026-10-21T00:36:24.094Z
NVD · CVE-2026-114045 · Updated 2026-10-22T15:44:59.783
Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00 - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-114045.json Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-106996 EUVD · EUVD-2026-106996
Technical & other
- https://access.redhat.com/security/cve/CVE-2026-114045 Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00
- https://bugzilla.redhat.com/show_bug.cgi?id=2557974 Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00
- https://www.cve.org/CVERecord?id=CVE-2026-114045 Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00
- https://nvd.nist.gov/vuln/detail/CVE-2026-114045 Red Hat · CVE-2026-114045 · Updated 2026-10-21T19:13:16+00:00