CVE-2026-33977: FreeRDP Client DoS Vulnerability

CVE-2026-33977 Overview

CVE-2026-33977 is a Denial of Service vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious RDP server can crash FreeRDP clients by sending specially crafted audio data in IMA ADPCM format containing an invalid initial step index value (>= 89). The unvalidated step index is read directly from the network and used to index into an 89-entry lookup table, triggering a WINPR_ASSERT() failure and process abort via SIGABRT.

Critical Impact

This vulnerability affects any FreeRDP client with audio redirection (RDPSND) enabled, which is the default configuration, allowing malicious RDP servers to reliably crash client connections.

Affected Products

• FreeRDP versions prior to 3.24.2
• FreeRDP clients with audio redirection (RDPSND) enabled
• Default FreeRDP client configurations

Discovery Timeline

• 2026-03-30 - CVE-2026-33977 published to NVD
• 2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-33977

Vulnerability Analysis

This vulnerability stems from improper input validation in FreeRDP's audio codec handling, specifically within the IMA ADPCM decoder. When processing audio data received from an RDP server, the FreeRDP client reads a step index value directly from the network data without verifying it falls within the valid range for the ima_step_size_table lookup table.

The IMA ADPCM algorithm uses a step size table containing 89 entries (indices 0-88) to decode compressed audio samples. When an attacker provides a step index value of 89 or greater, the code attempts to access memory outside the bounds of this table. Rather than causing a traditional buffer overflow, the FreeRDP implementation includes an assertion check (WINPR_ASSERT()) that detects this out-of-bounds condition and terminates the process with SIGABRT.

The attack can be executed remotely over the network without any authentication beyond establishing an RDP connection. User interaction is required as the victim must connect to the malicious RDP server. The impact is limited to availability—there is no confidentiality or integrity impact.

Root Cause

The root cause is a missing boundary validation check on the last_step index value received from network input before using it to index into the ima_step_size_table array. The step index is read from incoming audio packets and stored in adpcm->ima.last_step[channel] without verification that the value is within the valid range of 0-88.

Attack Vector

An attacker operating a malicious RDP server can exploit this vulnerability by:

1. Waiting for a FreeRDP client to connect with audio redirection enabled (default configuration)
2. Initiating an RDPSND audio stream with IMA ADPCM format
3. Sending a crafted audio packet containing a step index value >= 89
4. The client processes this packet, triggering the out-of-bounds table access
5. The WINPR_ASSERT() check fires, terminating the client process via SIGABRT

The following patch was applied in version 3.24.2 to address this vulnerability:

 	12635, 13899, 15289, 16818, 18500, 20350, 22385, 24623, 27086, 29794, 32767
 };
 
+static inline void dsp_ima_clamp_step(ADPCM* WINPR_RESTRICT adpcm, unsigned int channel)
+{
+	WINPR_ASSERT(adpcm);
+	if (adpcm->ima.last_step[channel] < 0)
+		adpcm->ima.last_step[channel] = 0;
+
+	const size_t size = ARRAYSIZE(ima_step_size_table);
+	if (adpcm->ima.last_step[channel] > size)
+		adpcm->ima.last_step[channel] = size;
+}
+
 static UINT16 dsp_decode_ima_adpcm_sample(ADPCM* WINPR_RESTRICT adpcm, unsigned int channel,
                                           BYTE sample)
 {

Source: GitHub Commit Details

Detection Methods for CVE-2026-33977

Indicators of Compromise

• Unexpected FreeRDP client crashes with SIGABRT signals during RDP sessions
• Core dumps or crash reports showing assertion failures in the libfreerdp/codec/dsp.c module
• Process termination logs indicating failures in IMA ADPCM audio decoding routines

Detection Strategies

• Monitor for FreeRDP client processes terminating abnormally with SIGABRT exit signals
• Implement network monitoring for RDP connections to untrusted or suspicious servers
• Deploy endpoint detection rules to identify crashes in FreeRDP with stack traces referencing dsp_decode_ima_adpcm_sample or related functions

Monitoring Recommendations

• Configure crash reporting to capture FreeRDP assertion failures and forward to security teams
• Log all outbound RDP connections and review connections to non-whitelisted servers
• Implement application-level monitoring to detect repeated FreeRDP client terminations

How to Mitigate CVE-2026-33977

Immediate Actions Required

• Upgrade FreeRDP to version 3.24.2 or later immediately
• Disable audio redirection (RDPSND) if not required by adding /sound:off to the connection parameters
• Restrict RDP connections to trusted, known servers only
• Review and harden RDP connection policies to prevent connections to untrusted endpoints

Patch Information

FreeRDP has released version 3.24.2 which includes a fix for this vulnerability. The patch introduces the dsp_ima_clamp_step() function that validates the step index value is within the valid range (0 to 88) before using it to index the lookup table. For additional details, refer to the GitHub Security Advisory GHSA-8f2g-3q27-6xm5.

Workarounds

• Disable audio redirection by launching FreeRDP with the /sound:off parameter
• Only connect to trusted RDP servers with verified identities
• Implement network-level controls to block outbound RDP connections to unauthorized destinations

# Disable audio redirection when connecting with FreeRDP
xfreerdp /v:server.example.com /u:username /sound:off

# Alternative: Disable audio in configuration file
echo "sound:off" >> ~/.config/freerdp/default.freerdp