How severe is CVE-2026-63633?

CVE-2026-63633 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2026-63633 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-63633?

CVE-2026-63633 affects Freerdp. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-63633?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2026-63633 published?

CVE-2026-63633 was published on 2026-08-19 and last updated on 2026-09-24.

CVE-2026-63633

CVE-2026-63633 is a critical-severity vulnerability in Freerdp with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-122.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
CVSS v4: 7.7
EPSS exploit prediction: 1% (48th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-122
Affected product: Freerdp
Published: 2026-08-19
Last modified: 2026-09-24

Description

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.

Frequently asked questions

What is CVE-2026-63633?: FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0, freerdp_dsp_decode_opus in libfreerdp/codec/dsp.c calls Stream_EnsureRemainingCapacity on context->common.buffer even though opus_decode writes decoded PCM into the caller-supplied out stream. A malicious RDP server that negotiates WAVE_FORMAT_OPUS with a client built with WITH_OPUS enabled and WITH_DSP_FFMPEG disabled can make libopus write a large decoded frame beyond the 4096-byte StreamPool_Take destination used by channels/rdpsnd/client/rdpsnd_main.c. This can corrupt the client heap, crash the client, and may permit code execution. This issue is fixed in version 3.28.0.
How severe is CVE-2026-63633?: CVE-2026-63633 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2026-63633 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (48th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-63633?: CVE-2026-63633 affects Freerdp. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-63633?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2026-63633 published?: CVE-2026-63633 was published on 2026-08-19 and last updated on 2026-09-24.

References

Affected products (1)

cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

More vulnerabilities in Freerdp

CVE-2026-55194 — Critical (CVSS 9.8): FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, rpc_client_recv_fragment in…
CVE-2026-55191 — Critical (CVSS 9.8): FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.27.0, FreeRDP clients that negotiate RDPGFX…
CVE-2026-67289 — Critical (CVSS 9.8): FreeRDP before 3.29.0 (affected versions <= 3.28.0) does not validate CRLF and control characters in the…
CVE-2026-66402 — Critical (CVSS 9.8): FreeRDP before 3.29.0 (affected versions <= 3.28.0) contains multiple TLS certificate identity validation weaknesses in…
CVE-2026-64620 — Critical (CVSS 9.8): FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common()…
CVE-2026-57156 — Critical (CVSS 9.8): FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.28.0 on 32-bit builds, FreeRDP clients…

All CVEs affecting Freerdp →

Other CWE-122 (Heap-based Buffer Overflow) vulnerabilities

CVE-2026-10747 — Critical (CVSS 10.0): IBM MQ Appliance could allow a remote attacker to cause a denial of service or potentially execute arbitrary code due…
CVE-2026-46752 — Critical (CVSS 10.0): Redis Lua HEAP overflow in cjson library vulnerability in Apache Kvrocks. This issue affects Apache Kvrocks: from…
CVE-2026-24822 — Critical (CVSS 10.0): Out-of-bounds Write, Heap-based Buffer Overflow vulnerability in ttttupup wxhelper (src modules). This vulnerability is…
CVE-2025-23123 — Critical (CVSS 10.0): A malicious actor with access to the management network could execute a remote code execution (RCE) by exploiting a…
CVE-2022-34819 — Critical (CVSS 10.0): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions <…
CVE-2026-10858 — Critical (CVSS 9.9): IBM MQ for HPE NonStop 8.1.0 through 8.1.0.40 could allow an authenticated attacker to cause a denial of service or…

Browse all CWE-122 (Heap-based Buffer Overflow) vulnerabilities →