CVE-2026-31885
Published: 13 March 2026
Summary
CVE-2026-31885 is a medium-severity Out-of-bounds Read (CWE-125) vulnerability in Freerdp Freerdp. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Credential Access (T1212); ranked at the 15.7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
OOB read in FreeRDP client decoder enables memory disclosure from process space when connecting to malicious RDP server or opening crafted RDP file; directly maps to exploitation for credential access via sensitive data leakage.
NVD Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.
Deeper analysisAI
CVE-2026-31885 is an out-of-bounds read vulnerability (CWE-125) in the MS-ADPCM and IMA-ADPCM decoders of FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). Versions prior to 3.24.0 are affected due to unchecked predictor and step_index values derived from untrusted input data. The issue was published on 2026-03-13 and carries a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), indicating medium severity with high confidentiality impact potential.
A remote attacker can exploit this vulnerability over the network with low complexity and no privileges required, but it necessitates user interaction, such as opening a malicious RDP file or connecting to a crafted RDP server using a vulnerable FreeRDP client. Successful exploitation triggers the out-of-bounds read, potentially allowing disclosure of sensitive information from process memory, though it does not affect integrity or availability.
The FreeRDP security advisory (GHSA-h23r-3988-3wf3) and associated commit (16df2300e1e3f5a51f68fb1626429e58b531b7c8) confirm the vulnerability is fixed in version 3.24.0, recommending immediate upgrades to patched releases for mitigation. No workarounds are specified beyond updating.
Details
- CWE(s)