CVE-2026-31885
Published: 13 March 2026
Summary
CVE-2026-31885 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Freerdp Freerdp. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Credential Access (T1212); ranked at the 17.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-31885 is an out-of-bounds read vulnerability (CWE-125) in the MS-ADPCM and IMA-ADPCM decoders of FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). Versions prior to 3.24.0 are affected due to unchecked predictor and step_index values derived from untrusted input data. The issue was published on 2026-03-13 and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact potential.
A remote attacker can exploit this vulnerability over the network with low complexity and no privileges required, but it necessitates user interaction, such as opening a malicious RDP file or connecting to a crafted RDP server using a vulnerable FreeRDP client. Successful exploitation triggers the out-of-bounds read, potentially allowing disclosure of sensitive information from process memory, though it does not affect integrity or availability.
The FreeRDP security advisory (GHSA-h23r-3988-3wf3) and associated commit (16df2300e1e3f5a51f68fb1626429e58b531b7c8) confirm the vulnerability is fixed in version 3.24.0, recommending immediate upgrades to patched releases for mitigation. No workarounds are specified beyond updating.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-12063
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in FreeRDP client decoder enables memory disclosure from process space when connecting to malicious RDP server or opening crafted RDP file; directly maps to exploitation for credential access via sensitive data leakage.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch that corrects the unchecked predictor/step_index values in the ADPCM decoders.
Mandates validation of untrusted input data, which would have rejected the out-of-range predictor and step_index values that trigger the out-of-bounds read.
Requires malicious-code protection mechanisms that can inspect or sandbox RDP content before it reaches the vulnerable ADPCM decoders.