CVE-2026-63633: FreeRDP WAVE_FORMAT_OPUS RCE Vulnerability

CVE-2026-63633 Overview

CVE-2026-63633 is a heap-based buffer overflow [CWE-122] in FreeRDP, an open source implementation of the Remote Desktop Protocol (RDP). The flaw resides in freerdp_dsp_decode_opus within libfreerdp/codec/dsp.c. The function calls Stream_EnsureRemainingCapacity on the wrong buffer, allowing opus_decode to write a decoded PCM frame past the 4096-byte destination allocated by StreamPool_Take in channels/rdpsnd/client/rdpsnd_main.c. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a vulnerable client can corrupt the heap. The issue affects FreeRDP versions prior to 3.28.0 built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled.

Critical Impact

A malicious RDP server can corrupt the client heap, crash the client, and potentially execute arbitrary code on connected FreeRDP clients.

Affected Products

• FreeRDP versions prior to 3.28.0
• Builds compiled with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled
• Client applications using the rdpsnd channel with Opus audio codec support

Discovery Timeline

• 2026-08-19 - CVE-2026-63633 published to NVD
• 2026-08-19 - Last updated in NVD database

Technical Details for CVE-2026-63633

Vulnerability Analysis

The vulnerability affects the FreeRDP audio processing pipeline when the client negotiates the Opus codec for the rdpsnd (RDP sound) virtual channel. The rdpsnd_main.c component obtains a fixed 4096-byte stream from StreamPool_Take to receive decoded audio. That output stream is passed to freerdp_dsp_decode_opus as the caller-supplied out buffer. Inside the decoder, opus_decode writes decoded PCM directly to out, but the capacity check operates on a different buffer entirely. Because Opus frames can produce up to 5760 samples per channel at 48 kHz, the resulting decoded PCM can exceed the destination allocation by a significant margin.

Root Cause

The defect is a target-buffer mismatch in the capacity check. The pre-patch code invokes Stream_EnsureRemainingCapacity(context->common.buffer, max_size) before decoding. However, opus_decode writes into the out stream provided by the caller, not context->common.buffer. The capacity guarantee therefore applies to the wrong allocation, leaving out sized at its original 4096 bytes while a much larger PCM frame is written into it. This produces a classic heap-based out-of-bounds write [CWE-122].

Attack Vector

Exploitation requires a victim to initiate an RDP session to an attacker-controlled server. The malicious server negotiates WAVE_FORMAT_OPUS during audio channel setup and returns a crafted Opus frame whose decoded size exceeds 4096 bytes. The overflow occurs in the client process heap, adjacent to metadata and other pool-managed stream allocations. Consequences range from process crash to potential code execution depending on heap layout and mitigations on the target platform. User interaction is required because the client must connect to the malicious server.

	/* Max packet duration is 120ms (5760 at 48KHz) */
	const size_t max_size = OPUS_MAX_FRAMES * context->common.format.nChannels * sizeof(int16_t);
-	if (!Stream_EnsureRemainingCapacity(context->common.buffer, max_size))
+	if (!Stream_EnsureRemainingCapacity(out, max_size))
 		return FALSE;

	const opus_int32 frames =

Source: FreeRDP commit 0ed1f95d. The patch replaces the incorrect buffer argument context->common.buffer with the actual destination out, ensuring the correct stream is resized before opus_decode writes decoded audio.

Detection Methods for CVE-2026-63633

Indicators of Compromise

• FreeRDP client process crashes or heap corruption reports occurring during or shortly after connection to an RDP server
• Outbound RDP (TCP/3389) connections from workstations to untrusted or unexpected external servers
• rdpsnd channel negotiation logs referencing WAVE_FORMAT_OPUS (format tag 0x704F) from unfamiliar servers

Detection Strategies

• Inventory FreeRDP builds across Linux and Unix endpoints and identify binaries linked against libopus without FFmpeg DSP support
• Alert on FreeRDP client versions below 3.28.0 through software asset management or endpoint telemetry
• Correlate FreeRDP process termination events with concurrent outbound RDP connections to flag possible exploitation attempts

Monitoring Recommendations

• Log and review outbound RDP sessions from user endpoints, especially to internet-facing hosts outside sanctioned RDP gateways
• Enable core dumps and crash reporting for FreeRDP clients to capture heap corruption artifacts for forensic analysis
• Monitor package managers and internal repositories for FreeRDP updates, ensuring 3.28.0 or later is deployed

How to Mitigate CVE-2026-63633

Immediate Actions Required

• Upgrade FreeRDP to version 3.28.0 or later on all affected systems (Release 3.28.0)
• Restrict outbound RDP connections from user endpoints to trusted destinations only through firewall or proxy policy
• Audit distributions and downstream packages (Linux distros, container images) that ship FreeRDP for backported fixes

Patch Information

The fix is available in FreeRDP 3.28.0, delivered through commit 0ed1f95d36913581cf31124f94eb5843d4263eae and pull request #12993. Additional details are published in GHSA-72j9-356v-88xq. The patch corrects the Stream_EnsureRemainingCapacity call to reference the actual output stream used by opus_decode.

Workarounds

• Rebuild FreeRDP with WITH_OPUS=OFF to disable the vulnerable Opus decode path
• Alternatively, build with WITH_DSP_FFMPEG=ON to route audio decoding through the FFmpeg-backed DSP that does not exhibit this flaw
• Instruct users to connect only to trusted RDP servers and block RDP to arbitrary internet hosts at the network egress

# Rebuild FreeRDP without the vulnerable Opus path
cmake -DWITH_OPUS=OFF -DWITH_DSP_FFMPEG=ON -B build -S .
cmake --build build

# Verify installed version is 3.28.0 or later
xfreerdp --version