Description
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
Published: 2026-10-16
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: heap out-of-bounds write
Action: Apply Patch
AI Analysis

Impact

FreeRDP 3.29.0 through 3.31.x contains an integer overflow in the Apple audin backends, where the audio queue buffer size is calculated using UINT32 arithmetic. If an attacker sends a FramesPerPacket value of 2^30 in the audin Open PDU, the multiplication FramesPerPacket × 2 × nChannels overflows, causing a smaller buffer allocation and a heap out-of-bounds write in macOS and iOS clients. This memory corruption can crash the application and cause unintended behavior.

Affected Systems

The vulnerability targets the FreeRDP client when running on macOS and iOS devices, affecting all releases from 3.29.0 up to, but not including, 3.32.0.

Risk and Exploitability

The CVSS score of 8.7 classifies the flaw as high severity. The EPSS score of < 1% indicates a very low but non-zero probability of exploitation. The flaw is triggered by a remote RDP server that sends a crafted audin Open PDU, meaning any client exposed to untrusted RDP traffic is at risk. The vulnerability is not listed in the CISA KEV catalog, indicating no known widespread exploitation at this time.

Generated by OpenCVE AI on October 16, 2026 at 15:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.32.0 or later, which removes the overflow by correcting the buffer size calculation.
  • Ensure the client binary in use is the patched release and eliminate any legacy, vulnerable binaries from the system.
  • Restrict RDP exposure by limiting inbound connections to trusted networks or routing traffic through a VPN, thereby reducing the attack surface for a malicious server.

Generated by OpenCVE AI on October 16, 2026 at 15:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 21 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Fri, 16 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
Title FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-190
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-21T02:06:15.611Z

Reserved: 2026-10-15T21:54:36.054Z

Link: CVE-2026-111380

cve-icon Vulnrichment

Updated: 2026-10-21T02:06:05.520Z

cve-icon NVD

Status : Modified

Published: 2026-10-16T03:18:05.123

Modified: 2026-10-21T03:17:18.237

Link: CVE-2026-111380

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-16T01:17:48Z

Links: CVE-2026-111380 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T14:15:09Z

Weaknesses
  • CWE-190

    Integer Overflow or Wraparound