CVE-2026-31883

FreeRDP (prior to 3.24.0) contains a heap-buffer-overflow in the RDPSND audio channel caused by a size_t underflow in the IMA-ADPCM and MS-ADPCM decoders (libfreerdp/codec/dsp.c). When nBlockAlign makes size % block_size == 0, subtraction of header sizes can underflow a size_t, wrapping to ~SIZE_...

Libnbd: crash or misbehaviour when nbd server returns an unexpected block size

...