CVE-2026-111380 — FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPack…
Published: 2026-10-16 · CVSS: 8.7 · CVSS 4.0
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7