CVE-2026-111380: FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audinmac.m, audinios.m), which compute the audio queue buffer size as FramesPerPacket 2 nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.32.0
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
macOS and iOS systems running FreeRDP versions from 3.29.0 up to, but not including, 3.32.0 are affected when using the Apple audin backends.
What must an attacker do to trigger the overflow?
An attacker needs to operate or control a malicious RDP server that the affected client connects to. The server sends an audin Open PDU with FramesPerPacket set to 2^30, causing the UINT32 buffer-size calculation to wrap and leading to an undersized allocation followed by a heap out-of-bounds write.
Does exploitation require credentials or local access?
The reported vector is network-based and requires no attacker privileges, but it requires user interaction: a user must connect the affected FreeRDP client to the malicious RDP server.
How can I determine whether a deployment is affected?
Check whether the FreeRDP client version is 3.29.0 or later and earlier than 3.32.0, and whether it is used on macOS or iOS with the Apple audin backend. The vulnerable code is in audin_mac.m and audin_ios.m.