Technical impact
FreeRDP prior to version 3.29.0 contains an integer overflow in the audio input redirection channel (audin). The FramesPerPacket value received from an RDP server is not validated, allowing an attacker to send a value that causes an allocation size to wrap around. This results in a heap‑based buffer overflow on platforms using the ALSA backend and a denial of service on all platforms that support the other backends, according to the CVE description. The vulnerability is classified as CWE‑122 and CWE‑190.
Affected Systems
All installations of FreeRDP that are earlier than version 3.29.0, on Windows, Linux, macOS, and Android platforms that use the ALSA, sndio, WinMM, or OpenSL ES audio back‑ends for the input channel. The flaw is present in the client component that processes FramesPerPacket sent by an RDP server.
Risk and Exploitability
The CVSS score of 7.7 indicates a high severity issue. The EPSS score is not available, so the exact probability of exploitation is unknown, but the vulnerability is considered high risk. The CVE is not listed in the CISA KEV catalog. The likely attack vector is remote, where an attacker who can control or influence an RDP server can send malicious FramesPerPacket values to a vulnerable FreeRDP client. Attack execution requires a client to process those frames; therefore, a network attacker who can establish an RDP session to a vulnerable client can exploit it.
