CVE-2026-63117: FreeRDP Server DoS Vulnerability

CVE-2026-63117 Overview

CVE-2026-63117 is a division-by-zero vulnerability [CWE-369] in FreeRDP, a widely deployed open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the server-side rdpsnd (RDP sound) channel handler, specifically the rdpsnd_server_select_format function in channels/rdpsnd/server/rdpsnd_main.c. An authenticated RDP client can advertise a malformed DVI ADPCM audio format that causes an internal block-size calculation to evaluate to zero. A subsequent modulo operation triggers SIGFPE, terminating the server-side sound channel process. FreeRDP maintainers addressed the issue in version 3.28.0.

Critical Impact
An authenticated client can crash the FreeRDP server-side rdpsnd channel process on demand, resulting in denial of service against affected RDP server implementations.

Affected Products

FreeRDP versions prior to 3.28.0
Server-side deployments exposing the rdpsnd virtual channel
Downstream projects and distributions bundling vulnerable FreeRDP releases

Discovery Timeline

2026-08-19 - CVE-2026-63117 published to NVD
2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-63117

Vulnerability Analysis

The vulnerability is triggered during RDP audio format negotiation. When a client connects to a FreeRDP-based server, it advertises a list of supported wave formats through the rdpsnd static virtual channel. The server calls rdpsnd_server_select_format to evaluate the client-supplied AUDIO_FORMAT structures and derive block-size parameters used for downstream framing math.

For DVI ADPCM (WAVE_FORMAT_DVI_ADPCM), the server computes an internal block size bs from nBlockAlign and nChannels. A client that advertises nBlockAlign = 8 and nChannels = 2 causes bs to resolve to zero. Later code executes out_frames % bs, and dividing by zero raises SIGFPE. The process handling the sound channel terminates immediately, denying audio functionality and disrupting the session.

Root Cause

The root cause is missing validation of client-controlled audio format parameters. The server accepted any nBlockAlign value for DVI ADPCM and ADPCM without enforcing the format-specific minimums required by the wave format specification. Because bs is derived arithmetically from these attacker-controlled fields, an unchecked low value produced a zero divisor.

Attack Vector

Exploitation requires an authenticated RDP session and network reachability to the FreeRDP server. The attacker sends a crafted Client Audio Formats and Version PDU during rdpsnd capability exchange. No user interaction on the server side is required.

// Patch: channels/rdpsnd/server/rdpsnd_main.c
// [channels,rdpsnd] tighten server side format checks

/* Some wave formats have stricter requirements */
switch (format->wFormatTag)
{
    case WAVE_FORMAT_DVI_ADPCM:
        if (format->nBlockAlign < 4)
        {
            WLog_ERR(TAG,
                     "invalid client audio format %s: nBlockAlign is %" PRIu32
                     ", must be >= 4",
                     audio_format_get_tag_string(format->wFormatTag), format->nBlockAlign);
            error = ERROR_INVALID_DATA;
            goto out_free;
        }
        break;
    case WAVE_FORMAT_ADPCM:
        if (format->nBlockAlign < 8)
        {
            WLog_ERR(TAG,
                     "invalid client audio format %s: nBlockAlign is %" PRIu32
                     ", must be >= 8",
                     audio_format_get_tag_string(format->wFormatTag), format->nBlockAlign);
            error = ERROR_INVALID_DATA;
            goto out_free;
        }
        break;
    default:
        break;
}

Source: FreeRDP commit b78fc0b. The fix rejects DVI ADPCM formats with nBlockAlign < 4 and ADPCM formats with nBlockAlign < 8, returning ERROR_INVALID_DATA before any block-size math executes.

Detection Methods for CVE-2026-63117

Indicators of Compromise

Server-side rdpsnd process termination with SIGFPE (signal 8) recorded in kernel or systemd logs shortly after an RDP session begins.
FreeRDP log entries referencing rdpsnd_server_select_format or abrupt channel disconnection during audio format negotiation.
Repeated short-lived authenticated RDP sessions from the same client immediately followed by sound channel crashes.

Detection Strategies

Monitor process supervisors (systemd, container runtimes) for repeated restarts of FreeRDP server binaries or child processes handling the sound channel.
Inspect RDP protocol traces for Client Audio Formats PDU messages advertising WAVE_FORMAT_DVI_ADPCM with nBlockAlign values below 4.
Correlate authenticated RDP logons with subsequent SIGFPE core dumps on the same host within a short time window.

Monitoring Recommendations

Enable core dump capture on FreeRDP server processes to preserve evidence when SIGFPE is raised.
Aggregate FreeRDP application logs into a centralized logging pipeline and alert on repeated ERROR_INVALID_DATA or channel-terminated events.
Track the version of FreeRDP deployed across the estate and alert when hosts run releases prior to 3.28.0.

How to Mitigate CVE-2026-63117

Immediate Actions Required

Upgrade FreeRDP to version 3.28.0 or later on every host exposing an RDP server built on FreeRDP libraries.
Restrict inbound RDP access to trusted networks and enforce strong authentication to reduce the pool of clients that can reach the vulnerable code path.
Review process supervision so that any crash in the rdpsnd handler triggers alerts rather than silent restarts.

Patch Information

The fix is included in the FreeRDP 3.28.0 release, tracked via pull request #12980 and detailed in the GHSA-v64m-xxfw-hrv6 advisory. The commit b78fc0b enforces minimum nBlockAlign values for DVI ADPCM and ADPCM formats before any downstream arithmetic executes.

Workarounds

Disable the rdpsnd server-side channel where audio redirection is not required.
Terminate RDP sessions from clients that repeatedly trigger SIGFPE in the sound channel and block the originating source addresses.
Isolate FreeRDP server processes with systemd restart limits or container restart policies to prevent crash loops from being weaponized as sustained denial of service.

bash

# Verify installed FreeRDP version and rebuild from patched source
freerdp-shadow-cli --version

git clone https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
git checkout 3.28.0
cmake -B build -S . -DWITH_SERVER=ON
cmake --build build --parallel
sudo cmake --install build