Is CVE-2026-110837 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-110837 being exploited in the wild.

How severe is CVE-2026-110837?

High severity, with a CVSS score of 7.1, published 14 October 2026.

Which products and versions are affected?

FreeRDP Project FreeRDP 2.0.0 before 3.32.0.

Is there a fix for CVE-2026-110837?

Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-110837 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-110837?

Check whether you run FreeRDP or FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-110837: FreeRDP heap-based buffer overflow in MP3 audio decoding

CVE-2026-110837 · Severity: high · CVSS 7.1 · Published 2026-10-14

FreeRDP is a client that allows users to connect to remote Windows desktops over RDP. When built with LAME MP3 support but without FFmpeg acceleration, a malicious RDP server can send specially crafted MP3 audio that causes a heap buffer overflow, crashing the FreeRDP client and potentially allowing an attacker to execute code on the client system.

Technologies: FreeRDP, FreeRDP Project FreeRDP. Vendors: FreeRDP, FreeRDP Project.

Quick answers

Is CVE-2026-110837 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-110837 being exploited in the wild.
How severe is CVE-2026-110837?: High severity, with a CVSS score of 7.1, published 14 October 2026.
Which products and versions are affected?: FreeRDP Project FreeRDP 2.0.0 before 3.32.0.
Is there a fix for CVE-2026-110837?: Yes: fixed in 3.32.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110837 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-110837?: Check whether you run FreeRDP or FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 3.32.0

Technical details

The vulnerability exists in freerdp_dsp_decode_mp3 when FreeRDP is built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF. The code reserves a heap buffer for PCM output but treats a byte count as short (2-byte) element offsets when positioning the right-channel pointer, placing it beyond the allocated buffer. A remote RDP server can exploit this by sending MP3 audio via RDPSND that causes decoded right-channel samples to overflow the heap boundary, confirmed to crash clients via buffer overflow detection.

Affected products

FreeRDP Project FreeRDP 2.0.0 before 3.32.0

Timeline

2026-09-30: disclosed
2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.