CVE-2026-63633

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.

• CWE-122

• https://github.com/FreeRDP/FreeRDP/commit/0ed1f95d36913581cf31124f94eb5843d4263eaePatch
• https://github.com/FreeRDP/FreeRDP/pull/12993Issue Tracking, Patch
• https://github.com/FreeRDP/FreeRDP/releases/tag/3.28.0Release Notes
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72j9-356v-88xqExploit, Mitigation, Vendor Advisory

Published

Aug 19, 2026

Last Modified

Sep 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-63623A flaw was found in libvirt. During storage volume clone or …5.5
• CVE-2026-63627mppx is a TypeScript interface for machine payments protocol…6.9
• CVE-2026-63628mppx is a TypeScript interface for machine payments protocol…6.9
• CVE-2026-6363Type Confusion in V8 in Google Chrome prior to 147.0.7727.10…8.8
• CVE-2026-63630BentoPDF is a client-side PDF toolkit that is self hostable.…3.4
• CVE-2026-63632Open Neural Network Exchange (ONNX) is an open standard for …3.3
• CVE-2026-63635OpenImageIO is a toolset for reading, writing, and manipulat…5.5
• CVE-2026-63637Dgraph is an open source distributed GraphQL database. Prior…8.6
• CVE-2026-63638OpenImageIO is a toolset for reading, writing, and manipulat…8.3
• CVE-2026-63639Valkey is a distributed key-value database. Prior to 7.2.14,…8.8
• CVE-2026-6364Out of bounds read in Skia in Google Chrome prior to 147.0.7…6.5
• CVE-2026-63640MagicMirror² is an open source modular smart mirror platform…4.3