Executive brief
FreeRDP is an open-source Remote Desktop Protocol server commonly used in virtualization and remote access solutions. An authenticated attacker can trigger a denial-of-service condition by sending a specially crafted audio format message that causes the rdpsnd sound channel to crash, disrupting remote desktop sessions.
Technical details
The vulnerability is a division by zero (SIGFPE) in the rdpsnd_server_select_format function within channels/rdpsnd/server/rdpsnd_main.c. An authenticated RDP client can advertise DVI ADPCM audio format with nBlockAlign set to 8 and nChannels set to 2, causing a `bs` (block size) calculation to become zero. Subsequent modulo operations using this zero value trigger SIGFPE and crash the rdpsnd channel process. The attack requires a valid RDP authentication but no special privileges. The vulnerability was patched in FreeRDP 3.28.0 by adding tighter server-side format validation checks.
Affected products
- FreeRDP FreeRDP prior to 3.28.0
Timeline
- 2026-08-19: disclosed
- 2026-06-29: patched: Fix merged in PR #12980, released in version 3.28.0