ANT-2026-EWM7B5QP · freerdp/freerdp · Heap Buffer Overflow

🗓️ 28 Sep 2026 21:59:08Reported by AnthropicType

anthropic🔗 red.anthropic.com👁 5 Views

Remote heap overflow in FreeRDP via opus_decode() in the rdpsnd channel.

Reporter	Title	Published	Views	Family All 35
Tenable Nessus	Amazon Linux 2023 : freerdp, freerdp-devel, freerdp-libs (ALAS2023-2026-2142)	14 Sep 202600:00	–	nessus
Tenable Nessus	AlmaLinux 10 : freerdp (ALSA-2026:61378)	5 Sep 202600:00	–	nessus
Tenable Nessus	Rocky Linux 10.2 [CIQ] Security Update: freerdp / freerdp-debuginfo / freerdp-debugsource / freerdp-devel / etc Multiple Vulnerabilities (crlsa-2026_61378)	1 Oct 202600:00	–	nessus
Tenable Nessus	Oracle Linux 10 : ELSA-2026-61378-0: / freerdp (ELSA-2026-613780)	4 Sep 202600:00	–	nessus
Tenable Nessus	RHEL 10 : freerdp (RHSA-2026:61378)	31 Aug 202600:00	–	nessus
Tenable Nessus	RHEL 10 : freerdp (RHSA-2026:68706)	17 Sep 202600:00	–	nessus
Tenable Nessus	RockyLinux 10 : freerdp (RLSA-2026:61378)	1 Sep 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2026-63633	20 Aug 202600:00	–	nessus
Amazon	Important: freerdp	14 Sep 202600:00	–	amazon
BDU FSTEC	Vulnerability of the freerdp_dsp_decode_opus() function in the libfreerdp/codec/dsp.c file of the RDP client FreeRDP, which allows a hacker to trigger a service denial and execute arbitrary code.	21 Aug 202600:00	–	bdu_fstec

Source	Link
github	www.github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eae
github	www.github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xq
github	www.github.com/advisories/GHSA-72j9-356v-88xq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-63633

28 Sep 2026 21:59Current

6.7Medium risk

Vulners AI Score6.7

CVSS 3.19.8

CVSS 47.7

EPSS0.00619

SSVC

freerdp libfreerdp heap buffer overflow rdpsnd opus_decode memory corruption