CVE-2026-31885
published 2026-03-13CVE-2026-31885: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to…
PriorityP347critical9.4CVSS 3.1
AVNACLPRNUINSUCHILAH
EPSS
0.26%
17.9th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.24.0+dfsg-1 (forky) | freerdp3 3.24.0+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.24.0+dfsg-1 (forky) | freerdp3 3.24.0+dfsg-1 (forky) |
| freerdp | freerdp | < 3.24.0 | 3.24.0 |
CVSS provenance
nvdv3.19.4CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H
osv9.4CRITICAL
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2026-31885: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-03-13·CVSS 9.4
CVE-2026-31885 [CRITICAL] CVE-2026-31885: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Red Hat
freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
vendor_redhat·2026-03-13·CVSS 6.5
CVE-2026-31885 [MEDIUM] CWE-125 freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
An out of bounds read flaw has been discovered in FreeRDP. This out-of-bounds read exists in the MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. An attacker may be able to leverage this weakness to leak global data.
Mitigation: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of u
Debian
CVE-2026-31885: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0...
vendor_debian·2026·CVSS 6.5
CVE-2026-31885 [MEDIUM] CVE-2026-31885: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Scope: local
bookworm: open
bullseye: open
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-31885 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.5
CVE-2026-31885 [MEDIUM] CVE-2026-31885 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-31885 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Source : NVD
## 9.4
Score
Published March 13, 2026
Severity CRITICAL
CNA Score 6.5
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 10
Exploitation Probability (EPSS) N/A
Affected packages and libraries
libwinpr-debuginfo
freerdp3
Sources
NVD
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22 Severity
Bugzilla
CVE-2026-31885 freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
bugzilla·2026-03-13·CVSS 9.4
CVE-2026-31885 [CRITICAL] CVE-2026-31885 freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
CVE-2026-31885 freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Discussion:
This issue has been addressed in the following products:
Red Hat Enterprise Linux 10
Via RHSA-2026:16014 https://access.redhat.com/errata/RHSA-2026:16014
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 8
Via RHSA-2026:16019 https://access.redhat.com/errata/RHSA-2026:16019
2026-03-13
Published