Live › vulnerability › CVE-2026-111380
Go to dashboardFreeRDP's macOS and iOS audio-input (audin) backends compute the audio buffer size as FramesPerPacket * 2 * nChannels in 32-bit arithmetic. A malicious RDP server can send FramesPerPacket = 2^30 in the audin Open PDU. That value passes the earlier CVE-2026-91962 check, wraps the size to 0 bytes, and causes a heap out-of-bounds write in the client. The result can be a crash or possibly code execution. The victim has to connect to the server. Linux and Windows builds, and Red Hat packages, are not affected because they lack these backends.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| freerdp | vendor | >= 3.29.0, < 3.32.0 | 3.32.0 |
xfreerdp --version (or sdl-freerdp --version), or brew list --versions freerdp3.29.0 up to but not including 3.32.0 is vulnerable3.32.0 or later (fix is in the FreeRDP 3.32.0 release)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
This page as .md · .json · in your agent: get_signal("CVE-2026-111380")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.