CVE-2026-63117
MediumCVSS 6.5Summary
FreeRDP prior to 3.28.0 has a vulnerability where an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
Risk Assessment
The risk includes the possibility of remotely crashing the RDP server process, leading to service unavailability and potential system integrity issues.
Recommendation
It is recommended to upgrade FreeRDP to version 3.28.0 or later, which includes the fix. Also, restrict access to the RDP server to trusted clients only.
Original NVD description (English source)
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.