CVE-2026-31884
Freerdp ≤ 3.24.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2026-31884 is a medium-severity Divide By Zero (CWE-369) vulnerability in Freerdp Freerdp. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 22th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-31884 is a division-by-zero vulnerability in the MS-ADPCM and IMA-ADPCM decoders of FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.24.0. The issue occurs in libfreerdp/codec/dsp.c when processing audio data from the Server Audio Formats PDU on the RDPSND channel. Specifically, the decoders perform a modulo operation using block_size derived from the unvalidated nBlockAlign field; if nBlockAlign is 0, this triggers a SIGFPE (floating-point exception), resulting in a crash. The vulnerability is classified under CWE-369 (Divide by Zero) with a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).
A remote attacker can exploit this vulnerability over the network by tricking a user into connecting a FreeRDP client to a malicious RDP server. The attacker sends a crafted Server Audio Formats PDU with nBlockAlign set to 0, which propagates without validation to the decoder. No privileges are required on the attacker's part, but user interaction is needed to initiate the RDP connection. Successful exploitation causes a denial-of-service via client crash, with no impact on confidentiality or integrity.
The FreeRDP security advisory (GHSA-jp7m-94ww-p56r) and related commits detail the fix in version 3.24.0, which adds validation to prevent zero values from reaching the decoder. Security practitioners should upgrade FreeRDP clients to 3.24.0 or later; patch details are available in commits 03b48b3601d867afccac1cdc6081de7a275edce7 and 16df2300e1e3f5a51f68fb1626429e58b531b7c8 on the FreeRDP GitHub repository.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12062
Vulnerability Data
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % block_size where block_size…
more
= context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation (including static/dynamic analysis) finds divide-by-zero conditions after they have been coded.
Security engineering principles can require safe-arithmetic constructs or explicit guards that keep division operands nonzero.
Validating numeric inputs before use as divisors structurally blocks zero values from reaching division operations.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include code analysis, input validation, and testing that prevent divide-by-zero errors.
Vulnerability identification processes can discover divide-by-zero flaws via static analysis or testing.
Routine patching and replacement can remediate divide-by-zero bugs present in deployed software.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development can detect divide-by-zero conditions before release.
Secure development lifecycle includes input validation and error-handling practices that can prevent divide-by-zero faults.
Application security requirements can mandate checks for zero denominators and safe arithmetic handling.
Secure architecture principles encourage defensive coding patterns that avoid arithmetic exceptions.
Secure coding standards directly require validation to prevent divide-by-zero and similar runtime faults.