CVE-2026-31885

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-31885
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31885.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-31885
Aliases
  • GHSA-h23r-3988-3wf3
Downstream
Related
Published
2026-03-13T17:38:23.756Z
Modified
2026-07-11T06:13:22.904167Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N CVSS Calculator
Summary
FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
Details

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.24.0, there is an out-of-bounds read in MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. This vulnerability is fixed in 3.24.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31885.json"
}
References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type
GIT
Repo
https://github.com/freerdp/freerdp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
b00402d3258402c868224b6ffed04182cbed78d9
Fixed
16df2300e1e3f5a51f68fb1626429e58b531b7c8
Database specific 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.24.0"
        }
    ],
    "cpe": "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.0-beta1
1.0-beta2
1.0-beta4
1.0-beta5
1.0.0
1.0.1
1.1.0-beta+2013071101
1.1.0-beta1
1.1.0-beta1+android2
1.1.0-beta1+android3
1.1.0-beta1+android4
1.1.0-beta1+android5
1.1.0-beta1+ios1
1.1.0-beta1+ios2
1.1.0-beta1+ios3
1.1.0-beta1+ios4
1.2.0-beta1+android7
1.2.0-beta1+android9
2.*
2.0.0
2.0.0-beta1+android10
2.0.0-beta1+android11
2.0.0-rc0
2.0.0-rc1
2.0.0-rc2
2.0.0-rc3
2.0.0-rc4
3.*
3.0.0
3.0.0-beta1
3.0.0-beta2
3.0.0-beta3
3.0.0-beta4
3.0.0-rc0
3.1.0
3.2.0
3.3.0
3.4.0
3.5.0
3.5.1

Database specific

vanir_signatures 
[
    {
        "signature_version": "v1",
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "212731737089159605375517359580886006715",
                "139873816408339546422196035502642067988",
                "126327654174851527600626574431365058888",
                "314701943587466846584475885568349287278",
                "134610532970381811251076748555624331390",
                "161720441546590988001080019558556013812",
                "31193019128046382149874890073308007778",
                "326386075875002422105258074446352684201",
                "220443047107610415697832373322416782210",
                "302513974905585474269555318346982146073",
                "150479357356205835889652419742180927250",
                "47246790825000604703488887533518263370",
                "314852034546563033316636978287529287384",
                "50246046811396058445809003269475255944",
                "218608584170853999662679748484671339411",
                "266311953527628264225352903204254527331",
                "24925819976979304659609590243311686432",
                "185600611847306178947029791945826857960",
                "47891120733981859626748926740098421615",
                "207317563697998597721261021674694164586",
                "305505221598441109824277041936010779377",
                "116277812540751737267972737263659058202",
                "6716142030359999324293342039470409806",
                "107375910519169308109544291698054368064",
                "141375167982756501456999718232803616802",
                "313418068344467865469508022796395092406",
                "157162119707041287539511222802056135617",
                "314807042199741186137538581435624611810",
                "225686689742412715257773647290257307859",
                "252698569406665309529796982549401074528",
                "18377605059883256154555583937814686841",
                "223972868504183062529685010766743874630",
                "17594543588403066084698461869127390687",
                "228295035706021204146972268596037498660",
                "236833401724907218086413022563527081966",
                "95412987132645868121386312435345154449",
                "164341330524644441597111555586337719888",
                "321247843301289133663816926220489362733",
                "7702261423345470066286797421206454028",
                "154622046691294963305667007535671394457",
                "22682955202860668735574204420482394822",
                "185193732421050911040218286684124601723",
                "111419416403057565498171489427875750417",
                "187604935626577372966923322770977173669",
                "319252545858434390659649847179035118009",
                "323895372640911653276888599729109252499",
                "233142573860328866469024700214870500571",
                "330792290652803536692332685550666882414",
                "192685404468812185912898231225175004556",
                "311604111557637033317031527420460440387",
                "128456682622139787343073352412271395179",
                "268719839138808531860009287537974662217",
                "20381976672324823680988852960517469931",
                "229064109775569341527707953910789014847",
                "220204378486839205913075864253005163069",
                "136336513492747933730867792607434121291",
                "85486664042986598670538135494119566699",
                "183806175542740126142183207351193527321",
                "198407561169945306244847903286549083226",
                "94056937764742508849543726444275972779",
                "85486664042986598670538135494119566699",
                "333074141710635353878506192750459148821",
                "262275100303909687623434936219445131319",
                "257241572780522891985902266297197987020",
                "133493841756435889099551840965496012237",
                "74231954606833113174283563071393663483",
                "222462785817676446504487561720852427627",
                "267453968374271614918090158647656010781",
                "216167218975962924297923596368934255340",
                "104513930213633182386549517572286360578",
                "2902605348454079937606403145172915427",
                "84749078992380556628603659274088527919",
                "74727223236359867458570668392810844322",
                "323406941527606750466199714563809471383",
                "53992946171295919942383255159049605765"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "libfreerdp/codec/dsp.c"
        },
        "id": "CVE-2026-31885-11d04e0a",
        "source": "https://github.com/freerdp/freerdp/commit/16df2300e1e3f5a51f68fb1626429e58b531b7c8",
        "signature_type": "Line"
    }
]
vanir_signatures_modified 
"2026-07-11T06:13:22Z"
source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31885.json"