{"id":"CVE-2026-111380","kind":"vulnerability","aliases":["CVE-2026-111380"],"related":[],"title":"FreeRDP: integer overflow in Apple audio backend lets a server write heap memory","description":"FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.","summary":"FreeRDP's macOS and iOS audio-input (audin) backends compute the audio buffer size as FramesPerPacket * 2 * nChannels in 32-bit arithmetic. A malicious RDP server can send FramesPerPacket = 2^30 in the audin Open PDU. That value passes the earlier CVE-2026-91962 check, wraps the size to 0 bytes, and causes a heap out-of-bounds write in the client. The result can be a crash or possibly code execution. The victim has to connect to the server. Linux and Windows builds, and Red Hat packages, are not affected because they lack these backends.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"freerdp","fixed":["3.32.0"],"affected":">= 3.29.0, < 3.32.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["freerdp","ios","macos","package","rdp-clients"],"not_affected_if":["audio-redirection-disabled","linux","no-audio-redirection","non-apple-clients","red-hat-packages","versions-below-3.29.0","windows"],"how_to_check":"Only matters on macOS or iOS builds of FreeRDP (audin_mac.m / audin_ios.m). Run 'xfreerdp --version' (or 'sdl-freerdp --version'), or 'brew list --versions freerdp'. Any version from 3.29.0 up to but not including 3.32.0 is vulnerable. Check whether your build or app bundles libfreerdp, including iOS RDP apps built on it. Connecting only to trusted servers, or running with audio redirection off (no /audio-mode or /microphone), is a mitigation; I did not confirm the exact switch.","fix":"Upgrade FreeRDP to 3.32.0 or later (fix is in the FreeRDP 3.32.0 release). Rebuild any app that bundles libfreerdp. Do not connect to untrusted RDP servers until then.","status":"open","published_at":"2026-10-16T03:18:05+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-23T22:34:56+00:00","updated_at":"2026-10-24T00:28:56+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:34:56Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade FreeRDP to 3.32.0 or later, which is the fixed version.","reach":"network","title":"FreeRDP: integer overflow in Apple audio backend lets a server write heap memory","impact":"high","summary":"FreeRDP's macOS and iOS audio redirection code multiplies sizes in 32-bit arithmetic, so a malicious RDP server can make the client allocate a too-small buffer. The client then writes past the end of that heap buffer, which can crash it or possibly run attacker code.","category":"package","who_cares":["freerdp","macos","ios","rdp-clients"],"confidence":0.7,"needs_auth":"no","worst_case":"malicious server writes out of bounds on client heap, possible code execution","analyst_note":"Confirm whether audio redirection (audin) is enabled by default in FreeRDP clients and check the NVD page for the exact trigger conditions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["versions-below-3.29.0","non-apple-clients","audio-redirection-disabled"],"user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000512,"input_tokens":3061,"output_tokens":412,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm whether audio redirection (audin) is enabled by default in FreeRDP clients and check the NVD page for the exact trigger conditions.","search":"'-111380':16A,19A '-2026':15A,18A,71B,161C '-91962':72B,162C '0':78B '2':45B,58B,153C,172C '3.29.0':128C '3.32.0':130C '30':59B,173C '32':48B 'affect':120B 'alloc':186C 'appl':5A,137C 'arithmet':50B,157C 'audin':36B,62B,138C,140C,142C,176C 'audio':6A,34B,40B,147C 'audio-input':33B 'audioqueueallocatebuff':185C 'backend':7A,37B,125B,139C 'bit':49B 'bound':87B,193C 'buffer':41B,149C 'build':113B 'bypass':158C 'byte':79B 'caus':81B,183C 'check':73B 'client':27B,91B,199C 'code':100B 'comput':38B,145C 'connect':106B 'contain':131C 'crash':97B 'cve':14A,17A,70B,160C 'earlier':69B 'execut':101B 'fix':163C 'framesperpacket':44B,57B,152C,170C 'freerdp':1A,20A,21B,28B,126C 'hat':116B 'heap':12A,83B,189C 'input':35B 'integ':2A,133C 'io':22B,32B,198C 'ios.m':143C 'lack':123B 'let':8A 'linux':110B 'mac.m':141C 'maco':23B,30B,196C 'malici':52B,165C 'memori':13A 'multipl':182C 'nchannel':46B,154C 'open':63B,177C 'out-of-bound':84B,190C 'overflow':3A,134C 'packag':24B,117B 'pass':67B 'pdu':64B,178C 'possibl':99B 'queue':148C 'rdp':26B,53B,166C 'rdp-client':25B 'red':115B 'result':93B 'send':56B,169C 'server':10A,54B,109B,167C 'size':42B,76B,150C 'uint32':156C 'unders':184C 'valu':66B 'victim':103B 'window':112B 'wrap':74B,180C 'write':11A,88B,194C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T03:18:05+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111380","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111380","severity":null,"published_at":"2026-10-16T03:18:05+00:00","modified_at":"2026-10-21T03:17:18+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111380:672","url":null,"severity":null,"published_at":"2026-10-24T00:28:56+00:00","modified_at":"2026-10-24T00:28:56+00:00","first_seen_at":"2026-10-24T00:28:56+00:00","fetched_at":"2026-10-24T00:28:56+00:00","note":"Read FreeRDP GHSA-72qv-gcph-rfwf (vendor), VulnCheck, Red Hat. Only macOS/iOS builds affected; bypass of CVE-2026-91962 fix. Self-contained PoC arithmetic in GHSA, no weaponized exploit or exploitation reports; X count 1 post, no discussion. Unconfirmed: whether audin is enabled by default (advisory says the server just advertises the audin channel; client-side default unverified). GHSA says affected <=3.31.0, CVE/VulnCheck say >=3.29.0 <3.32.0; kept the CVE range."}],"documents":[{"id":2629,"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf","title":"FreeRDP GHSA-72qv-gcph-rfwf: UINT32 overflow in audin Apple backends","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":2630,"url":"https://access.redhat.com/security/cve/cve-2026-111380","title":"Red Hat: CVE-2026-111380 (not affected, no Apple audin backends)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null},{"id":2631,"url":"https://www.vulncheck.com/advisories/freerdp-3.29.0-before-3.32.0-heap-overflow-via-audin-apple-backends","title":"VulnCheck: FreeRDP 3.29.0 before 3.32.0 heap overflow via audin Apple backends","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}