This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-63117 →
DEBIAN-CVE-2026-63117
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign...
Original description
The description as published by the source.
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, an authenticated RDP client can advertise DVI ADPCM with nBlockAlign equal to 8 and nChannels equal to 2 to make the bs calculation in rdpsnd_server_select_format in channels/rdpsnd/server/rdpsnd_main.c equal zero. The subsequent out_frames modulo bs operation raises SIGFPE and terminates the server-side rdpsnd channel process. This vulnerability fixed in 3.28.0.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
freerdp2
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:13
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]
Debian:14
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.28.0+dfsg-1"}]}]
References
- advisory security-tracker.debian.org