Bug 2552978 (CVE-2026-110837) - CVE-2026-110837 freerdp: freerdp: Denial of Service via heap-based buffer overflow during MP3 audio decoding
Summary: CVE-2026-110837 freerdp: freerdp: Denial of Service via heap-based buffer ove...
Keywords:
Status: NEW
Alias: CVE-2026-110837
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-14 23:03 UTC by OSIDB Bzimport
Modified: 2026-10-16 06:40 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-14 23:03:05 UTC 
FreeRDP 2.0.0 before 3.32.0, when built with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, has a heap-based buffer overflow in freerdp_dsp_decode_mp3 because the right-channel PCM pointer is offset by a byte count treated as short elements. A malicious RDP server can send MP3 audio over rdpsnd so decoded samples cross the heap allocation, crashing the client.
Note You need to log in before you can comment on or make changes to this bug.