CVE-2026-31885 is an out-of-bounds read in FreeRDP's MS-ADPCM and IMA-ADPCM audio decoders, scored 6.5 by NVD. Values taken from the input data were used as array indexes without being checked. Upgrade FreeRDP to 3.24.0 or later.
What's affected
FreeRDP 3.23.0 and earlier. The fixed version is 3.24.0.
The advisory describes two spots in the audio decoders. In one, a predictor byte from the data was used to index a table that holds only seven entries. In the other, a step index from a block header indexed a table of 89 entries. Both values can range up to 255 in the data.
How to check if you're exposed
FreeRDP is both a library and a set of clients, so check the build you actually run. For the command line client:
xfreerdp /version
Other tools that embed libfreerdp, such as remote desktop clients packaged by a Linux distribution or bundled inside another application, carry their own copy or depend on the distribution's package. Check your package manager for the installed version, for example apt list --installed 2>/dev/null | grep -i freerdp on Debian based systems.
What to do now
- Upgrade FreeRDP to 3.24.0 or later.
- Apply the matching package updates on systems where FreeRDP comes from your distribution.
- Ask vendors of RDP clients that embed libfreerdp whether their latest build includes 3.24.0.
- Remember CVE-2026-31883 and CVE-2026-31897 are fixed in the same release, so one upgrade covers all three.
Why it matters
The class is CWE-125, out-of-bounds read. The program trusted a number from outside as a safe array index. When the number is larger than the table, the read lands in whatever memory follows.
A read bug is usually less severe than a write bug, and the score reflects that. It can still crash the client or reveal bytes the program should not expose. Reads from the read-only data section of a program are a common first step in memory corruption research, which is a reason to patch even when the direct impact looks small.
The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog, and no advisory I read says it is exploited in the wild. Treat it as a patch to schedule promptly, not a fire drill, unless your own logs say otherwise.
Quick check
Is this the same bug as CVE-2026-31883?
No. Both are in the ADPCM decoders and share a fixed release. This one is an out-of-bounds read from unchecked indexes. The other is a write caused by an integer underflow.
Sources
Last reviewed: 19 October 2026.
