CVE-2026-31884

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31884
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31884.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-31884
Aliases
  • GHSA-jp7m-94ww-p56r
Downstream
Related
Published
2026-03-13T17:36:57.722Z
Modified
2026-08-18T18:39:22.488114Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVSS Calculator
Summary
FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, division by zero in MS-ADPCM and IMA-ADPCM decoders when nBlockAlign is 0, leading to a crash. In libfreerdp/codec/dsp.c, both ADPCM decoders use size % blocksize where blocksize = context->common.format.nBlockAlign. The nBlockAlign value comes from the Server Audio Formats PDU on the RDPSND channel. The value 0 is not validated anywhere before reaching the decoder. When nBlockAlign = 0, the modulo operation causes a SIGFPE (floating point exception) crash. This vulnerability is fixed in 3.24.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-369"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31884.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b00402d3258402c868224b6ffed04182cbed78d9
Fixed
03b48b3601d867afccac1cdc6081de7a275edce7
Fixed
16df2300e1e3f5a51f68fb1626429e58b531b7c8
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.24.0"
        }
    ],
    "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

vanir_signatures 
[
    {
        "signature_type": "Line",
        "id": "CVE-2026-31884-11d04e0a",
        "target": {
            "file": "libfreerdp/codec/dsp.c"
        },
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "212731737089159605375517359580886006715",
                "139873816408339546422196035502642067988",
                "126327654174851527600626574431365058888",
                "314701943587466846584475885568349287278",
                "134610532970381811251076748555624331390",
                "161720441546590988001080019558556013812",
                "31193019128046382149874890073308007778",
                "326386075875002422105258074446352684201",
                "220443047107610415697832373322416782210",
                "302513974905585474269555318346982146073",
                "150479357356205835889652419742180927250",
                "47246790825000604703488887533518263370",
                "314852034546563033316636978287529287384",
                "50246046811396058445809003269475255944",
                "218608584170853999662679748484671339411",
                "266311953527628264225352903204254527331",
                "24925819976979304659609590243311686432",
                "185600611847306178947029791945826857960",
                "47891120733981859626748926740098421615",
                "207317563697998597721261021674694164586",
                "305505221598441109824277041936010779377",
                "116277812540751737267972737263659058202",
                "6716142030359999324293342039470409806",
                "107375910519169308109544291698054368064",
                "141375167982756501456999718232803616802",
                "313418068344467865469508022796395092406",
                "157162119707041287539511222802056135617",
                "314807042199741186137538581435624611810",
                "225686689742412715257773647290257307859",
                "252698569406665309529796982549401074528",
                "18377605059883256154555583937814686841",
                "223972868504183062529685010766743874630",
                "17594543588403066084698461869127390687",
                "228295035706021204146972268596037498660",
                "236833401724907218086413022563527081966",
                "95412987132645868121386312435345154449",
                "164341330524644441597111555586337719888",
                "321247843301289133663816926220489362733",
                "7702261423345470066286797421206454028",
                "154622046691294963305667007535671394457",
                "22682955202860668735574204420482394822",
                "185193732421050911040218286684124601723",
                "111419416403057565498171489427875750417",
                "187604935626577372966923322770977173669",
                "319252545858434390659649847179035118009",
                "323895372640911653276888599729109252499",
                "233142573860328866469024700214870500571",
                "330792290652803536692332685550666882414",
                "192685404468812185912898231225175004556",
                "311604111557637033317031527420460440387",
                "128456682622139787343073352412271395179",
                "268719839138808531860009287537974662217",
                "20381976672324823680988852960517469931",
                "229064109775569341527707953910789014847",
                "220204378486839205913075864253005163069",
                "136336513492747933730867792607434121291",
                "85486664042986598670538135494119566699",
                "183806175542740126142183207351193527321",
                "198407561169945306244847903286549083226",
                "94056937764742508849543726444275972779",
                "85486664042986598670538135494119566699",
                "333074141710635353878506192750459148821",
                "262275100303909687623434936219445131319",
                "257241572780522891985902266297197987020",
                "133493841756435889099551840965496012237",
                "74231954606833113174283563071393663483",
                "222462785817676446504487561720852427627",
                "267453968374271614918090158647656010781",
                "216167218975962924297923596368934255340",
                "104513930213633182386549517572286360578",
                "2902605348454079937606403145172915427",
                "84749078992380556628603659274088527919",
                "74727223236359867458570668392810844322",
                "323406941527606750466199714563809471383",
                "53992946171295919942383255159049605765"
            ]
        },
        "deprecated": false
    },
    {
        "signature_type": "Line",
        "id": "CVE-2026-31884-bbaa1dab",
        "target": {
            "file": "libfreerdp/codec/dsp.c"
        },
        "signature_version": "v1",
        "source": "https://github.com/freerdp/freerdp/commit/03b48b3601d867afccac1cdc6081de7a275edce7",
        "digest": {
            "threshold": 0.9,
            "line_hashes": [
                "131066561843354495178151874733639007424",
                "67950466556312886147432865143831748992",
                "258058590774085504450479845526466489486",
                "76624106550431597786069072612047208730",
                "168356016362427213364312842500026614106",
                "181818710675053873824473667922285537775",
                "108391432888781123634031196167080135431",
                "165218486659140697090698700239600599981",
                "308798407444057328516497203810411613262",
                "171637704598313146639302100525174668966",
                "185274289170342642091364036981544170156",
                "314151997804681838837963758347121067736",
                "125045716457481628766622565525638848579",
                "85420496564378944755929510778639857689",
                "328961870347177906453085544735465824723",
                "133943567847030144904971901874937009304",
                "15486988161946123751082563128156491282",
                "70761640908129304171176065535742490464",
                "270309378594372044685979196509714169946",
                "48319175860930188341483567784756572558",
                "119208567003100408559297420711348887619",
                "308221831362593514748770348979795814221",
                "44573593799800443449098205487509997680",
                "268622573234813463613809645002896806097",
                "128167897846635981070816141771684342918",
                "187726308642281497517488626208629857823",
                "221211051965250177119340106152770546204",
                "61447899959414035471725160491372079613",
                "85245175222979795524224458980397116062",
                "98458464680326471791906282528132780941",
                "99519771385214962985353710179161647686",
                "101264581200401488138603408760488975425",
                "306438772146128690638482031307328134975",
                "97756899457132113057715039816498977133",
                "1262995767693549212554302238141987501",
                "233624093219492352017727783934386198181",
                "114408124821172390998025852728062156640",
                "237011274959795055646636115970659372827",
                "282272389938196310945906294735489978086",
                "187298458783290243374513693900229070369",
                "296805384504080105163667573970319707083",
                "308620003209948859581820685822421439300",
                "7689798992573416741245294420490952506",
                "325112600349686503057746635048004481159",
                "142604493929640819970781194463224762943",
                "157006610100128538771112229688803366653",
                "91037570296931285134242993465454486641",
                "174139609452934687515569831697778552923",
                "231716819501491730549578892822175344408",
                "328153110276539474043809502507324149308",
                "232721502513118291969961451148861822020",
                "227173993065181462947872379572589619234",
                "316059832047227374518521178987037688780",
                "167891499926448206652161581741296139511",
                "286880710370038134078160876588507925813",
                "195549371008612533478131486292491098968",
                "108127996797551820063898137297330811744",
                "264614000905033497899421535949000683878",
                "117575252970437810641592215369928933851",
                "273009366035335216940792331464758108833",
                "195049579868113339906247877495401012401",
                "7454282809092540335852215329491908782",
                "69747602149259590387895271460948690513",
                "118434830195517002697624163302932488489",
                "196193814070891237568285535078197822403",
                "175169876336692766239872463666319589527",
                "225152836784413929571462418894092466947",
                "328594796304974117603047556951547827792",
                "114911771645285420057526440334990468705",
                "111681867377884429877353326393580316141",
                "307658736329980876219478099976521329807",
                "304829084642952867993764782782307803311",
                "174769607398896482291013084690103855868",
                "167764914676727664497031404523850160317",
                "338711704942870438624943233705905838079",
                "338755664122979209303346686023230216258",
                "45086985700125158395276122319220027611",
                "307914753950671721098245221659585319905",
                "44112382619556457023442975092347272654",
                "55010312711865762226707650548087662851",
                "311269524825019497042634827296288772070",
                "139665204344472556372927004520431252296",
                "142602897281246214655971529761712181191",
                "292686114033386712578311259311081700520",
                "171506035374152540035789858833443679552",
                "269113415862572252344772432780776733718",
                "264388321561285212307600398667409953804",
                "252724723376348559116664603909685688456",
                "76883934410831469314819456102110812262",
                "165765398302148725643523363026569503211",
                "96781523389391576066793556242098158388",
                "68753671980567674635647712687261991454"
            ]
        },
        "deprecated": false
    }
]
vanir_signatures_modified 
"2026-08-18T18:39:22Z"
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31884.json"