CVE-2026-63117Medium· 6.5▾ SunlitFreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the `bs` calculation in rdpsnd_server_sele…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.6%
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the bs calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo bs operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
freerdp < 3.28.0Upgrade past the affected range:
freerdp 3.28.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-91955High· 7.5FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server
CVE-2026-63633Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-63652Medium· 6.5FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-67302Medium· 4.3FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains a divide-by-zero vulnerability in the rdpecam camera redirection client
CVE-2026-114041Medium· 6.5freerdp: FreeRDP: Windows RD Gateway consent message heap out-of-bounds read (CVE-2026-114041)
CVE-2026-114042Medium· 6.5FreeRDP 3.32.0 Use-After-Free via drdynvc Virtual Channel PDU