CVE-2026-63633 FreeRDP CVE debrief

Who should care

Defenders responsible for systems using FreeRDP should assess exposure and prioritize updating to version 3.28.0 or later. This includes reviewing RDP access controls and monitoring for suspicious RDP activity. Defenders should also verify affected versions and exposure, and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, defenders should track exceptions, retest remediated assets, and close the  

Why it matters

CVE-2026-63633 is a vulnerability in FreeRDP that can cause heap corruption and potentially allow for code execution. Defenders should prioritize updating to version 3.28.0 or later and review RDP access controls.

• Potential code execution on vulnerable systems
• Heap corruption and client crashes
• Requires verification of affected versions and exposure
• Remediation priority for RDP-exposed systems

Technical summary

The vulnerability exists in the freerdp_dsp_decode_opus function in libfreerdp/codec/dsp.c. A malicious RDP server can exploit this vulnerability by negotiating WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled. This can cause a heap corruption and potentially allow for code execution. The issue is fixed in version 3.28.0. Defenders should prioritize updating to version 3.28.0 or later to mitigate this vulnerability. The vulnerability can cause heap corruption and potentially allow for code execution.

Defensive priority

Defenders should prioritize updating to version 3.28.0 or later to mitigate this vulnerability.

Recommended defensive actions

• Update to version 3.28.0 or later
• Review and restrict RDP access to trusted sources
• Monitor for suspicious RDP activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability exists in the freerdp_dsp_decode_opus function in libfreerdp/codec/dsp.c. A malicious RDP server can exploit this vulnerability by negotiating WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.