# CVE-2026-114045: FreeRDP heap buffer overflow in rdpsnd server channel

Source: https://junglewise.ai/threats/cve-2026-114045-freerdp-before-3-32-1-contains-a-heap-based-buffer-overflow-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114045 · Severity: high · CVSS 8.8 · Published 2026-10-21

FreeRDP is a remote desktop protocol implementation used in many applications and services. A malicious RDP client can exploit an integer wraparound vulnerability in the audio channel handler to write arbitrary data to the server's heap memory, potentially achieving remote code execution on systems that host RDP servers. This affects any system using vulnerable FreeRDP versions with audio channel support enabled.

Technologies: [FreeRDP Project FreeRDP](https://junglewise.ai/threats/technologies/freerdp-project-freerdp). Vendors: [FreeRDP Project](https://junglewise.ai/threats/vendors/freerdp-project).

## Quick answers

**Is CVE-2026-114045 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114045 being exploited in the wild.

**How severe is CVE-2026-114045?** High severity, with a CVSS score of 8.8, published 21 October 2026.

**Which products and versions are affected?** FreeRDP Project FreeRDP before 3.32.1.

**Is there a fix for CVE-2026-114045?** Yes: fixed in 3.32.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114045 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114045?** Check whether you run FreeRDP Project FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.1

## Technical details

A heap-based buffer overflow (CWE-122 via CWE-190) exists in the rdpsnd server channel's rdpsnd_server_select_format() function. An attacker-controlled RDP client sends two SNDC_FORMATS PDUs with a crafted nBlockAlign value that is too small relative to nChannels, triggering an integer wraparound in DVI_ADPCM block-alignment arithmetic that bypasses validation guards. This causes an unbounded sequential heap write when the server processes subsequent audio playback events. The vulnerability requires an authenticated RDP connection (or no authentication in certain deployments).

## Affected products

- FreeRDP Project FreeRDP before 3.32.1

## Timeline

- 2026-10-05: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-3m9q-g533-rqjq)
- [https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format](https://www.vulncheck.com/advisories/freerdp-before-3.32.1-heap-buffer-overflow-via-rdpsnd-server-select-format)

## Related threats

- [FreeRDP heap buffer overflow in transport_default_read_pdu](https://junglewise.ai/threats/cve-2026-121962-freerdp-before-3-32-2-contains-a-heap-buffer-overflow-in)
- [FreeRDP use-after-free in DRDYNVC tracker race condition](https://junglewise.ai/threats/cve-2026-121961-freerdp-before-3-32-2-contains-a-use-after-free-vulnerability-in)
- [FreeRDP infinite loop in WebSocket frame handling](https://junglewise.ai/threats/cve-2026-121959-freerdp-before-3-32-2-contains-an-infinite-loop-vulnerability-in)
- [FreeRDP server denial of service in RDP peer input parsing](https://junglewise.ai/threats/cve-2026-121951-freerdp-3-0-0-before-3-32-2-server-side-rdp-peer-input-parsing)
- [FreeRDP NULL pointer dereference in RDPGFX ResetGraphics](https://junglewise.ai/threats/cve-2026-121402-freerdp-before-3-32-2-contains-a-null-pointer-dereference)