---
id: "CVE-2026-111380"
kind: "vulnerability"
aliases: ["CVE-2026-111380"]
title: "FreeRDP: integer overflow in Apple audio backend lets a server write heap memory"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "freerdp", "fixed": ["3.32.0"], "affected": ">= 3.29.0, < 3.32.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["freerdp", "ios", "macos", "package", "rdp-clients"]
not_affected_if: ["audio-redirection-disabled", "linux", "no-audio-redirection", "non-apple-clients", "red-hat-packages", "versions-below-3.29.0", "windows"]
published_at: "2026-10-16T03:18:05+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-24T00:28:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111380", "first_seen_at": "2026-10-23T21:57:12+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-24T00:28:56+00:00"}]
---

# FreeRDP: integer overflow in Apple audio backend lets a server write heap memory

FreeRDP's macOS and iOS audio-input (audin) backends compute the audio buffer size as FramesPerPacket * 2 * nChannels in 32-bit arithmetic. A malicious RDP server can send FramesPerPacket = 2^30 in the audin Open PDU. That value passes the earlier CVE-2026-91962 check, wraps the size to 0 bytes, and causes a heap out-of-bounds write in the client. The result can be a crash or possibly code execution. The victim has to connect to the server. Linux and Windows builds, and Red Hat packages, are not affected because they lack these backends.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:freerdp affected >= 3.29.0, < 3.32.0 fixed 3.32.0

## How to check

Only matters on macOS or iOS builds of FreeRDP (audin_mac.m / audin_ios.m). Run 'xfreerdp --version' (or 'sdl-freerdp --version'), or 'brew list --versions freerdp'. Any version from 3.29.0 up to but not including 3.32.0 is vulnerable. Check whether your build or app bundles libfreerdp, including iOS RDP apps built on it. Connecting only to trusted servers, or running with audio redirection off (no /audio-mode or /microphone), is a mitigation; I did not confirm the exact switch.

## Fix

Upgrade FreeRDP to 3.32.0 or later (fix is in the FreeRDP 3.32.0 release). Rebuild any app that bundles libfreerdp. Do not connect to untrusted RDP servers until then.

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111380
- 2026-10-24T00:28:56+00:00 analyst — Read FreeRDP GHSA-72qv-gcph-rfwf (vendor), VulnCheck, Red Hat. Only macOS/iOS builds affected; bypass of CVE-2026-91962 fix. Self-contained PoC arithmetic in GHSA, no weaponized exploit or exploitation reports; X count 1 post, no discussion. Unconfirmed: whether audin is enabled by default (advisory says the server just advertises the audin channel; client-side default unverified). GHSA says affected <=3.31.0, CVE/VulnCheck say >=3.29.0 <3.32.0; kept the CVE range.

## Documents

- [advisory] FreeRDP GHSA-72qv-gcph-rfwf: UINT32 overflow in audin Apple backends https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf
- [describes] VulnCheck: FreeRDP 3.29.0 before 3.32.0 heap overflow via audin Apple backends https://www.vulncheck.com/advisories/freerdp-3.29.0-before-3.32.0-heap-overflow-via-audin-apple-backends
- [mentions] Red Hat: CVE-2026-111380 (not affected, no Apple audin backends) https://access.redhat.com/security/cve/cve-2026-111380

## From the sources

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_