CVE-2026-110837

Executive Summary

CVE-2026-110837 is a heap-based buffer overflow (CWE-122) in FreeRDP versions 2.0.0 through 3.31.x when compiled with the WITH_LAME=ON and WITH_DSP_FFMPEG=OFF build flags. The flaw resides in freerdp_dsp_decode_mp3, where a right-channel PCM pointer is offset by a byte count incorrectly treated as short elements, allowing heap memory to be overrun during MP3 audio decoding delivered over the rdpsnd virtual channel. A malicious or compromised RDP server can send crafted MP3 audio to crash the client and potentially achieve limited memory corruption, yielding a client-side availability and integrity risk with CVSS 7.1 (AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:H). The vulnerability is currently unpatched according to all tracked sources, and no public PoC, exploit code, or Nuclei template exists.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) used by clients and servers across Windows, Linux, macOS, and embedded platforms. The rdpsnd virtual channel negotiates audio playback between an RDP server and the client. When audio is transmitted in MP3 format, the client decodes incoming streams using a DSP backend. The build configuration determines which backend is used: WITH_DSP_FFMPEG=OFF disables the FFmpeg decoder, and WITH_LAME=ON enables the LAME MP3 decoder path.

The vulnerability is a heap-based buffer overflow (CWE-122) in the function named in the advisory, freerdp_dsp_decode_mp3. According to the NVD description, the defect is an element-size confusion: the pointer for the right-channel PCM (pulse-code modulation) output buffer is advanced by an offset expressed in bytes, but that offset is subsequently interpreted as a count of short (16-bit) elements. This creates a scaling mismatch — the actual memory displacement is twice (or otherwise inconsistently proportional to) the intended displacement — so decoded right-channel samples are written past the end of the heap allocation that backs the PCM buffer. Because the overflow occurs during sample-by-sample decode writes, the overwrite can be gradual and may not immediately fault, which complicates detection while increasing the chance of silent heap corruption before a crash.

The attack surface is the audio subsystem of the RDP client, specifically any FreeRDP build that meets both build prerequisites (WITH_LAME=ON, WITH_DSP_FFMPEG=OFF). The vulnerable code path is only reachable when an RDP server transmits MP3-encoded audio over rdpsnd. The server is treated as untrusted in this threat model, meaning a malicious or compromised RDP endpoint can trigger the flaw without any client-side user interaction beyond establishing the session. The overflow writes decoded PCM samples, which limits the attacker's control over payload bytes to attacker-influenced audio sample data, but the element-size confusion can still corrupt adjacent heap metadata or objects, presenting opportunities for further exploitation in the worst case.

Notably, the advisory does not describe any command-injection, authentication bypass, or remote code execution primitive. The described outcome is a client crash due to samples crossing the heap allocation boundary. Any escalation beyond crash requires attackers to shape heap layout via repeated session interactions and audio payloads, which is non-trivial and accounts for the AC:H (high attack complexity) rating in the CVSS vector. No public PoC or exploit code is available, so the exact sample values and stream structure required are not documented.

Preconditions for exploitation are therefore: (1) the victim runs a FreeRDP build configured with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF, (2) audio redirection over rdpsnd is enabled and negotiated, and (3) the client connects to an attacker-controlled or compromised RDP server that can send MP3 audio. The attacker needs only low privileges relative to the client's trust boundary (PR:L in the vector) since the malicious party is the remote server the client chooses to trust.

Insufficient technical detail is available in the advisory to specify exact buffer sizes, allocation routines, or the precise audio payload structure; the mechanistic description above is limited to what the NVD entry states and to the general behavior of element-size confusion overflows in decoder implementations.

Exploitation Scenarios

No public exploit or PoC exists for CVE-2026-110837; the chain below is inferred from the vulnerability class (heap-based buffer overflow via element-size confusion in an audio codec) and the advisory's stated attack vector (malicious RDP server over rdpsnd).

1. Reconnaissance / target identification. The attacker identifies endpoints running FreeRDP with audio redirection enabled — for example, thin clients, Linux workstations, or embedded devices using FreeRDP-based clients. Because the flaw requires a specific compile-time configuration (WITH_LAME=ON, WITH_DSP_FFMPEG=OFF), the attacker benefits from knowing or inferring client build flags, which may be leaked by client banners, package availability in the OS distribution, or documented vendor build configurations. No Shodan-based build-flag enumeration is reliable here; the practical reconnaissance is limited to knowing the target's distribution and FreeRDP package build options.

2. Triggering the flaw class. The attacker operates an RDP server (or compromises one) that the victim client connects to. During session establishment, the rdpsnd virtual channel is negotiated, and the server elects to transmit audio in MP3 format. The client, with WITH_DSP_FFMPEG=OFF and WITH_LAME=ON, routes decoding to freerdp_dsp_decode_mp3. When the decoder processes the right channel, the PCM output pointer is offset by a byte count treated as short elements, displacing subsequent writes past the heap allocation that holds the PCM buffer. This is triggered by crafted audio content and the code path itself, not by malformed RDP headers alone.

3. Payload/execution method (vulnerability-class level). The attacker controls the MP3 audio bytes streamed over rdpsnd. Those bytes become decoded sample values. Because the overflow writes decoded samples past the intended allocation, the attacker can influence a portion of the overwritten memory with audio-derived data, but precise control over the overwrite value is constrained by the codec output. No documented technique exists for CVE-2026-110837 to chain this into control-flow hijack; the stated observable outcome is a client crash. In controlled lab conditions, a successful trigger is demonstrated by a crash in the client process with a stack trace tagged to freerdp_dsp_decode_mp3.

4. Post-exploitation impact. In the demonstrated case, the impact is denial of service against the RDP client (crash). In a worst-case interpretation of CWE-122 in a decoder routine, heap corruption could theoretically be leveraged for further memory-safety impacts, but the advisory does not establish code execution, and no exploit evidence supports that escalation. The CVSS vector's I:H (High integrity) reflects the potential for heap-state corruption of the client process; C:L (Low confidentiality) reflects limited information exposure via memory corruption side effects; A:H (High availability) reflects the reliable crash outcome. No credential theft, lateral movement, or persistence is demonstrated by the available data.

Impact Assessment

CVE-2026-110837 affects FreeRDP 2.0.0 through 3.31.x builds compiled with WITH_LAME=ON and WITH_DSP_FFMPEG=OFF. The blast radius is any client session in which the victim connects to an attacker-controlled or compromised RDP server and audio redirection is active. This is a client-side memory-safety issue triggered by a remote peer; the server is untrusted, so the attack model is "malicious server attacks connecting client."

Business impact primarily manifests as client crash (availability loss) and possible heap corruption in the client process. On shared workstations, kiosks, or embedded thin clients, repeated crashes can be disruptive and, in some environments, may be exploited as a nuisance DoS during sensitive operations (e.g., breaking an interactive maintenance session). Because the CVSS attack vector is AV:N and PR:L, an attacker only needs to be able to participate as the remote RDP endpoint; there is no requirement that the client be exposed on the network. The AC:H rating reflects the difficulty of reliably shaping the heap corruption beyond a crash.

CVSS subscores: Confidentiality Low (C:L) — memory corruption can expose limited client-process data; Integrity High (I:H) — the overflow corrupts heap memory beyond the intended PCM buffer; Availability High (A:H) — a reliable crash of the RDP client. Scope is Unchanged (S:U), so impact is confined to the vulnerable component. No CISA KEV listing exists, no EPSS score has been published by FIRST.org, and no threat-actor campaign has been publicly attributed. Enterprises accepting inbound RDP connections from untrusted or external servers should treat this as a client-side risk; those using FreeRDP only as a server are not affected by this specific rdpsnd decode path as described.

Detection Guidance

Sigma Rule

title: FreeRDP MP3 Decoder Heap Overflow Attempt (CVE-2026-110837)
id: 7f3b8d21-6c4a-4e0e-9b2a-1a2b3c4d5e6f
status: experimental
description: Detects RDP client crashes accompanied by rdpsnd audio negotiation, consistent with exploitation of the freerdp_dsp_decode_mp3 heap overflow.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-110837
author: ValtersIT Threat Intelligence
date: 2026-01-01
tags:
  - attack.t1204
  - attack.t1499.004
logsource:
  product: linux
  service: auditd
detection:
  selection_process:
    type: 'EXECVE'
    a0|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/sdl-freerdp'
  selection_crash:
    type: 'ANOM_ABEND'
    comm|contains: 'freerdp'
  condition: selection_process and selection_crash
falsepositives:
  - Legitimate FreeRDP clients crashing for unrelated reasons
level: medium

YARA Rule

rule CVE_2026_110837_FreeRDP_MP3_Overflow
{
    meta:
        description = "Detects FreeRDP binaries built with LAME DSP support that may contain the freerdp_dsp_decode_mp3 heap overflow (CVE-2026-110837)"
        author = "ValtersIT Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-110837"
        date = "2026-01-01"
        severity = "high"

    strings:
        $lame = "lame" ascii wide nocase
        $dspfunc = "freerdp_dsp_decode_mp3" ascii
        $mp3 = "audio/mpeg" ascii nocase
        $rdpsnd = "rdpsnd" ascii nocase

    condition:
        uint16(0) == 0x5A4D and
        any of ($dspfunc, $mp3, $rdpsnd) and
        $lame
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-110837 FreeRDP rdpsnd MP3 audio channel negotiation"; flow:established,to_client; content:"rdpsnd"; nocase; content:"audio/mpeg"; nocase; distance:0; threshold: type limit, track by_src, count 1, seconds 60; classtype:attempted-dos; reference:cve,2026-110837; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-110837; sid:2026110837; rev:1;)

Elastic Detection

sequence by host.name with maxspan=60s
  [process where process.name in ("xfreerdp", "wlfreerdp", "sdl-freerdp") and event.action == "start"]
  [process where event.action == "end" and process.exit_code != 0 and process.name in ("xfreerdp", "wlfreerdp", "sdl-freerdp")]

Splunk SPL Query

index=main (source=linux_secure OR source=syslog)
| search ("freerdp" OR "xfreerdp" OR "wlfreerdp" OR "sdl-freerdp")
| search (rdpsnd OR "audio/mpeg" OR "SIGSEGV" OR "segfault" OR "core dumped")
| rex field=_raw "(?<process>\S*freerdp\S*)"
| stats count min(_time) as first_seen max(_time) as last_seen by host process
| where count > 1
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-110837,">
  <rule id="110837" level="10">
    <decoded_as>json</decoded_as>
    <match>freerdp_dsp_decode_mp3</match>
    <description>CVE-2026-110837: Potential FreeRDP MP3 decoder heap overflow triggered</description>
    <mitre>
      <id>T1204</id>
    </mitre>
  </rule>
  <rule id="110838" level="8">
    <if_sid>5100</if_sid>
    <match>xfreerdp|wlfreerdp|sdl-freerdp</match>
    <match>segfault|SIGSEGV|core dumped</match>
    <description>CVE-2026-110837: FreeRDP client crash possibly linked to remote MP3 audio overflow</description>
    <mitre>
      <id>T1499.004</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround list, or affected-version registry is available from tracked sources.

1. Immediate mitigations:

   • Disable audio redirection in FreeRDP clients where audio playback is not operationally required, since the vulnerable path requires rdpsnd negotiation and MP3 audio delivery.
   • Rebuild FreeRDP packages with WITH_DSP_FFMPEG=ON or with WITH_LAME=OFF where feasible; the advisory explicitly scopes the flaw to WITH_LAME=ON and WITH_DSP_FFMPEG=OFF.
   • Restrict which RDP servers clients are permitted to connect to (allowlist trusted endpoints) to reduce exposure to malicious or compromised servers.
   • Monitor for client crash events tied to freerdp_dsp_decode_mp3 to confirm no attempted exploitation is occurring in the environment.

2. Patch/upgrade steps:

   • Track the FreeRDP project for a release that addresses CVE-2026-110837; upgrade affected clients to 3.32.0 or later once available and verified.
   • If building from source, recompile with the non-vulnerable DSP configuration or apply the upstream fix commit once published.
   • Validate upgrades by confirming the build produces a client whose decoder path no longer matches the vulnerable configuration described in the advisory.

3. Long-term hardening:

   • Standardize client builds to one DSP backend and document build flags per platform to avoid silently reintroducing the vulnerable combination.
   • Run FreeRDP clients under OS-level exploit mitigations (ASLR, heap canaries, sandboxing) and, where supported, application sandboxing to contain heap corruption.
   • Deploy endpoint detection for client crashes in RDP-related processes and maintain an inventory of thin-client and embedded systems that ship FreeRDP.
   • Subscribe to FreeRDP security advisories and integrate CVE feeds into vulnerability management so the client-side library is included in coverage.

References

• NVD — CVE-2026-110837: https://nvd.nist.gov/vuln/detail/CVE-2026-110837
• CWE-122 Heap-based Buffer Overflow: https://cwe.mitre.org/data/definitions/122.html
• FreeRDP project: https://www.freerdp.com/
• CISA Known Exploited Vulnerabilities Catalog (search CVE-2026-110837 — not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• FIRST EPSS (no score published as of reporting): https://www.first.org/epss/