Gulamovzavohir02-Glitch

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.31.0 **Description** A denial-of-service issue exists in the URBDRC control-transfer request path. The software fails to validate the `OutputBufferSize` variable before forwarding it to the libusb backend. A malicious RDP server can send a control-transfer request with `OutputBufferSize` set to 65536, which triggers an assertion that terminates the client process. **Recommendations** Update to version 3.31.0 or later.

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions prior to 3.31.0 **Description** An integer overflow exists in the audin Apple backends when processing `FramesPerPacket` values from `MSG SNDIN OPEN` messages. An attacker can provide crafted `FramesPerPacket` values that cause the size computation in the `AudioQueueAllocateBuffer()` function to wrap. This leads to the allocation of an undersized buffer, which may result in out-of-bounds access. Real-world incidents indicate this issue has been exploited in the wild. **Recommendations** Update FreeRDP to version 3.31.0 or later.