CVE-2026-33977
published 2026-03-30CVE-2026-33977: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio…
PriorityP434medium6.5CVSS 3.1
AVNACLPRNUIRSUCNINAH
EPSS
0.26%
17.0th percentile
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | freerdp2 | < freerdp3 3.24.2+dfsg-1 (forky) | freerdp3 3.24.2+dfsg-1 (forky) |
| debian | freerdp3 | < freerdp3 3.24.2+dfsg-1 (forky) | freerdp3 3.24.2+dfsg-1 (forky) |
| freerdp | freerdp | < 3.24.2 | 3.24.2 |
| ubuntu | freerdp3 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
osv6.9MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
FreeRDP vulnerabilities
vendor_ubuntu·2026-07-20
CVE-2026-33995 FreeRDP vulnerabilities
Title: FreeRDP vulnerabilities
Summary: Several security issues were fixed in FreeRDP.
It was discovered that FreeRDP contained multiple security issues. An
attacker could possibly use these issues to obtain sensitive information,
cause FreeRDP to crash, resulting in a denial of service, or execute
arbitrary code.
Instructions: This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.
Red Hat
FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data
vendor_redhat·2026-03-30·CVSS 6.9
CVE-2026-33977 [MEDIUM] CWE-1285 FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data
FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit this vulnerability by sending spe
Debian
CVE-2026-33977: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
vendor_debian·2026·CVSS 6.9
CVE-2026-33977 [MEDIUM] CVE-2026-33977: freerdp2 - FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to versio...
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
Scope: local
bookworm: open
bullseye: open
OSV
CVE-2026-33977: FreeRDP is a free implementation of the Remote Desktop Protocol
osv·2026-03-30·CVSS 6.9
CVE-2026-33977 [MEDIUM] CVE-2026-33977: FreeRDP is a free implementation of the Remote Desktop Protocol
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-33977 freerdp2: FreeRDP: Denial of Service via malformed IMA ADPCM audio data [fedora-all]
bugzilla·2026-03-30·CVSS 6.5
CVE-2026-33977 [MEDIUM] CVE-2026-33977 freerdp2: FreeRDP: Denial of Service via malformed IMA ADPCM audio data [fedora-all]
CVE-2026-33977 freerdp2: FreeRDP: Denial of Service via malformed IMA ADPCM audio data [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
This bug appears to have been reported against 'rawhide' during the Fedora Linux 45 development cycle.
Changing version to 45.
Bugzilla
CVE-2026-33977 FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data
bugzilla·2026-03-30·CVSS 6.5
CVE-2026-33977 [MEDIUM] CVE-2026-33977 FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data
CVE-2026-33977 FreeRDP: FreeRDP: Denial of Service via malformed IMA ADPCM audio data
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
Wiz
CVE-2026-33977 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 6.9
CVE-2026-33977 [MEDIUM] CVE-2026-33977 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-33977 :
NixOS vulnerability analysis and mitigation
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, a malicious RDP server can crash the FreeRDP client by sending audio data in IMA ADPCM format with an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into a 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT. This affects any FreeRDP client that has audio redirection (RDPSND) enabled, which is the default configuration. This issue has been patched in version 3.24.2.
Source : NVD
## 6.9
Score
Published March 30, 2026
Severity MEDIUM
CNA Score 6.9
Affected Technologies
NixOS
Wolfi
Has Public Exploit Yes
Has CISA KEV
2026-03-30
Published