# CVE-2026-121387: FreeRDP out-of-bounds read in GSM610 audio decoder

Source: https://junglewise.ai/threats/cve-2026-121387-freerdp-2-0-0-before-3-32-2-contains-an-out-of-bounds-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-121387 · Severity: medium · CVSS 4.3 · Published 2026-11-03

FreeRDP is an open-source remote desktop protocol client used to connect to Windows and other systems. A malicious or compromised RDP server can crash the FreeRDP client by sending specially crafted truncated audio frames, causing a denial of service. This vulnerability only affects builds compiled with libgsm support and without the FFmpeg DSP backend, when audio playback is enabled.

## Quick answers

**Is CVE-2026-121387 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121387 being exploited in the wild.

**How severe is CVE-2026-121387?** Medium severity, with a CVSS score of 4.3, published 3 November 2026.

**Which products and versions are affected?** FreeRDP 2.0.0 through 3.32.1.

**Is there a fix for CVE-2026-121387?** Yes: fixed in 3.32.2. Until then: Disable audio playback, or build FreeRDP with FFmpeg DSP backend (WITH_DSP_FFMPEG=ON) instead of the built-in GSM decoder, or avoid connecting to untrusted RDP servers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-121387 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121387?** Check whether you run FreeRDP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 3.32.2

Disable audio playback, or build FreeRDP with FFmpeg DSP backend (WITH_DSP_FFMPEG=ON) instead of the built-in GSM decoder, or avoid connecting to untrusted RDP servers.

## Technical details

An out-of-bounds read vulnerability exists in the freerdp_dsp_decode_gsm610 function when decoding GSM610 WAV49 audio frames. The decoder calls the lengthless gsm_decode API before validating that a complete 32- or 33-byte frame is available, allowing a malicious server to supply truncated audio data that causes libgsm to read past the buffer boundary. The vulnerability requires the victim to connect to a malicious RDP server with audio enabled, specific build configuration (WITH_GSM=ON and WITH_DSP_FFMPEG=OFF), and GSM610 codec negotiation.

## Affected products

- FreeRDP 2.0.0 through 3.32.1

## Timeline

- 2026-10-19: disclosed: GitHub Security Advisory published
- 2026-11-03: patched: Fixed in version 3.32.2

## References

- [https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wg7g-gx9g-r96c](https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-wg7g-gx9g-r96c)
- [https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.2-out-of-bounds-read-via-gsm610-wav49-decoder](https://www.vulncheck.com/advisories/freerdp-2.0.0-before-3.32.2-out-of-bounds-read-via-gsm610-wav49-decoder)

## Related threats

- [FreeRDP RDPGFX integer wrap in surface allocation](https://junglewise.ai/threats/cve-2026-121950-freerdp-before-3-32-2-does-not-check-the-product-of-surface)