Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo `bs` operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T18:17:08.430Z",
  "pubdate": "2026-08-19T18:17:08.430Z",
  "executiveSummary": "An integer-based division-by-zero vulnerability exists in FreeRDP prior to version 3.28.0 within the Remote Desktop Protocol (RDP) sound server implementation.\nThe vulnerability allows an authenticated RDP client to trigger a SIGFPE signal, resulting in the abnormal termination of the server-side rdpsnd channel process.\nThe flaw affects FreeRDP server deployments handling client audio redirection channels prior to the 3.28.0 patch release.\nThe risk implication is a targeted denial-of-service affecting the audio subsystem of the RDP session or the associated channel process.\nAn attacker must possess valid RDP authentication to establish a session and interact with the server-side sound channel.\nExploitation requires the client to explicitly advertise manipulated audio format parameters during channel capability negotiation.",
  "technicalDetails": "The root cause of the vulnerability resides in the function rdpsnd_server_select_format located in channels/rdpsnd/server/rdpsnd_main.c.\nDuring the capability negotiation and format selection phase of the Remote Desktop Protocol sound channel (rdpsnd), the server processes format structures provided by the client.\nAn authenticated RDP client can maliciously advertise DVI ADPCM audio parameters configured with an nBlockAlign value equal to 8 and an nChannels value equal to 2.\nThese specific parameter values cause the internal block size bs calculation within rdpsnd_server_select_format to evaluate to zero.\nSubsequent execution performs an out_frames modulo bs operation, resulting in a hardware-level arithmetic exception due to integer division by zero.\nThe uncaught arithmetic exception raises a SIGFPE signal, forcing the immediate termination of the server-side rdpsnd channel process.\nThe affected component is the FreeRDP server-side sound redirection subsystem, specifically handling DVI ADPCM format selections.\nAffected software versions include all releases of FreeRDP prior to version 3.28.0.\nAttack requirements mandate that the adversary is an authenticated RDP client capable of initiating and negotiating parameters over the network-exposed rdpsnd virtual channel.\nNo elevated privileges beyond standard RDP authentication are required to interact with the vulnerable channel function.\nThe payload behavior is strictly destructive to the targeted process stability, causing a denial-of-service of the sound channel without achieving remote code execution."
}