CVE-2026-31884: FreeRDP ADPCM Decoder DoS Vulnerability

CVE-2026-31884 Overview

CVE-2026-31884 is a division by zero vulnerability affecting FreeRDP, a free implementation of the Remote Desktop Protocol. Prior to version 3.24.0, the MS-ADPCM and IMA-ADPCM audio decoders in FreeRDP fail to validate the nBlockAlign parameter before performing modulo operations, leading to a SIGFPE (floating point exception) crash when a malicious server sends a Server Audio Formats PDU with nBlockAlign set to 0.

Critical Impact

Remote attackers can crash FreeRDP clients by sending specially crafted audio format data over the RDPSND channel, causing denial of service conditions.

Affected Products

• FreeRDP versions prior to 3.24.0
• Applications and systems utilizing the FreeRDP library for RDP connections
• Linux, Windows, and macOS systems running vulnerable FreeRDP clients

Discovery Timeline

• 2026-03-13 - CVE-2026-31884 published to NVD
• 2026-03-17 - Last updated in NVD database

Technical Details for CVE-2026-31884

Vulnerability Analysis

This vulnerability is classified as CWE-369 (Divide By Zero) and affects the audio codec processing functionality within FreeRDP. The vulnerable code resides in libfreerdp/codec/dsp.c, where both the MS-ADPCM and IMA-ADPCM decoders perform a modulo operation using size % block_size, where block_size is derived from context->common.format.nBlockAlign.

The nBlockAlign value originates from the Server Audio Formats PDU transmitted over the RDPSND (Remote Desktop Protocol Sound) channel. When a malicious RDP server sends this PDU with nBlockAlign set to 0, the value propagates through the audio processing pipeline without any validation checks. Upon reaching the decoder, the modulo operation with a zero divisor triggers a SIGFPE signal, resulting in immediate process termination.

Root Cause

The root cause of this vulnerability is improper input validation. The FreeRDP codebase fails to validate that nBlockAlign is a non-zero value before using it as a divisor in arithmetic operations. This missing boundary check allows untrusted data from the network to directly influence a mathematical operation that requires a non-zero operand.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker operating a malicious RDP server can exploit this vulnerability by:

1. Waiting for a FreeRDP client to establish a connection
2. Sending a crafted Server Audio Formats PDU over the RDPSND channel with nBlockAlign set to 0
3. When the client attempts to process audio data using the compromised format parameters, the division by zero occurs

The vulnerability affects the availability of the client system but does not allow code execution or data exfiltration. The attack can be executed remotely over the network, making it exploitable in scenarios where users connect to untrusted RDP servers.

Detection Methods for CVE-2026-31884

Indicators of Compromise

• FreeRDP client processes terminating unexpectedly with SIGFPE signals
• Crash dumps indicating division by zero in libfreerdp/codec/dsp.c
• Abnormal Server Audio Formats PDUs with nBlockAlign values of 0 in network traffic
• Increased connection failures to specific RDP servers

Detection Strategies

• Monitor for process crashes with SIGFPE (signal 8) in FreeRDP client applications
• Implement network inspection rules to detect RDPSND channel PDUs with zero nBlockAlign values
• Deploy crash reporting mechanisms to capture and analyze FreeRDP termination events
• Use endpoint detection tools to correlate RDP connection activity with subsequent client crashes

Monitoring Recommendations

• Enable crash logging for all FreeRDP client deployments to capture vulnerability exploitation attempts
• Configure network monitoring to analyze RDP traffic for malformed audio format PDUs
• Establish baseline metrics for FreeRDP client stability to detect anomalous crash patterns
• Review connection logs to identify potentially malicious RDP servers triggering client crashes

How to Mitigate CVE-2026-31884

Immediate Actions Required

• Upgrade FreeRDP to version 3.24.0 or later immediately
• Restrict RDP connections to trusted, verified servers only
• Consider disabling audio redirection if not required for business operations
• Implement network segmentation to limit exposure to potentially malicious RDP servers

Patch Information

FreeRDP has released version 3.24.0 which addresses this vulnerability by adding proper validation for the nBlockAlign parameter before use in arithmetic operations. The fix has been implemented across two commits:

• FreeRDP Commit 03b48b36
• FreeRDP Commit 16df2300

For complete details, refer to the GitHub Security Advisory GHSA-jp7m-94ww-p56r.

Workarounds

• Disable audio redirection in FreeRDP client configurations using the /sound:off parameter
• Implement network-level filtering to block or inspect RDPSND channel traffic
• Use application allowlisting to restrict connections to known-good RDP servers
• Deploy crash protection mechanisms that can restart FreeRDP clients after unexpected termination

# Disable audio redirection in FreeRDP connection
xfreerdp /v:server.example.com /u:username /sound:off

# Alternative: Disable audio completely
xfreerdp /v:server.example.com /u:username -audio