CVE-2026-31883 is a heap buffer overflow write in FreeRDP, the open source Remote Desktop Protocol implementation. NVD scores it 6.5. A size calculation underflows in the IMA-ADPCM and MS-ADPCM audio decoders when handling data on the RDPSND channel. Upgrade to FreeRDP 3.24.0 or later.
What's affected
FreeRDP 3.23.0 and earlier. The advisory lists 3.24.0 as the patched version.
This is a client side problem. The data comes from the server end of an RDP session over the audio channel, so the people at risk are those who connect a FreeRDP based client to a server they do not fully trust.
Two sibling CVEs, CVE-2026-31885 and CVE-2026-31897, were fixed in the same release.
How to check if you're exposed
FreeRDP is both a library and a set of clients, so check the build you actually run. For the command line client:
xfreerdp /version
Other tools that embed libfreerdp, such as remote desktop clients packaged by a Linux distribution or bundled inside another application, carry their own copy or depend on the distribution's package. Check your package manager for the installed version, for example apt list --installed 2>/dev/null | grep -i freerdp on Debian based systems.
What to do now
- Upgrade FreeRDP to 3.24.0 or later, or install your distribution's update that includes it.
- Update applications that bundle libfreerdp once their vendors ship a build with the fix.
- Until you update, avoid connecting to RDP servers you do not control or trust.
- If your policy allows, disable audio redirection in RDP sessions, since the advisory path runs through the audio channel.
Why it matters
The weakness class is CWE-122, heap based buffer overflow, caused by CWE-191, integer underflow. The decoders subtracted block header sizes from an unsigned size variable without checking whether it was big enough. When the value was too small, it wrapped around to a huge number. The loop that follows then ran far past what the data justified and could write outside the allocated memory.
Integer wraparound in unsigned arithmetic is a standard source of memory bugs in C codecs. The input that triggers it comes from the network peer, which is why the audio channel counts as an attack surface even though people think of it as a harmless extra.
The NVD score of 6.5 reflects that the client must connect to a hostile or compromised server. For admins and helpdesk staff who connect to many hosts, that is a more realistic condition than it sounds.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Does it affect the server or the client?
The advisory describes data received over the RDPSND channel from the server, so the vulnerable code runs in the client.
Can I just turn off sound?
Disabling audio redirection avoids the described path, but the fixed release is the proper remedy.
Sources
Last reviewed: 19 October 2026.
