CVE-2026-63633 is a critical (CVSS 9.8) heap buffer overflow in the FreeRDP client, in the Opus audio decoder. A malicious RDP server can corrupt the client's memory. It affects FreeRDP up to 3.27.1 and is fixed in 3.28.0. Upgrade, and connect only to servers you trust.
What's affected
- FreeRDP versions up to and including 3.27.1. Fixed in 3.28.0.
- Function:
freerdp_dsp_decode_opusinlibfreerdp/codec/dsp.c. - Build condition: a client built with
WITH_OPUSenabled andWITH_DSP_FFMPEGdisabled, per the record. - Weakness: CWE-122, heap based buffer overflow. CVSS 9.8 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
The GitHub advisory rates it High and says the direction is server to client.
How to check if you're exposed
Find the FreeRDP version in every place it is installed or embedded.
xfreerdp --version 2>/dev/null || xfreerdp3 --version
# Debian and Ubuntu
dpkg -l | grep -i freerdp
# Red Hat family
rpm -qa | grep -i freerdp
FreeRDP is also embedded in remote desktop tools, gateways and appliances. For those, ask the vendor which FreeRDP version they ship. The free in-browser scan at gold.safeguard.sh/scan covers dependencies in your projects.
What to do now
- Find every FreeRDP client install and every product that embeds it.
- Upgrade to FreeRDP 3.28.0 or later, or to your distribution's patched package.
- Until then, connect only to RDP servers you control or trust.
- If you build FreeRDP yourself, note the Opus and FFmpeg build options. The affected path is the one with Opus enabled and the FFmpeg DSP disabled.
- Rebuild container images and application bundles that carry the library.
Why it matters
The decoder resized the wrong buffer before decoding audio. Opus decoding writes into a fixed size destination, and the decoded frame can be far larger than that destination. The advisory describes a write of several kilobytes past a 4 KB buffer, which corrupts nearby heap objects.
That is CWE-122. Heap corruption can crash the client and, in the worst case, allow code execution. The attacker has to be the server, or sit between the client and the server, so the main exposure is a user who connects to a server they do not control. The record's KEV flag is false.
An earlier FreeRDP fix for a similar overflow in the same file covered other audio decoders and did not touch the Opus path, according to the advisory.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Who does the attacker have to be?
A malicious RDP server, according to the record. The client is the victim.
Which build options matter?
The record names Opus enabled and the FFmpeg DSP disabled.
Sources
- FreeRDP advisory GHSA-72j9-356v-88xq
- FreeRDP 3.28.0 release (listed in the record)
Last reviewed: 19 October 2026.
