Thawkhant

**Name of the Vulnerable Software and Affected Versions** FreeRDP versions 3.29.0 through 3.31.0 **Description** An integer overflow exists in the Apple audin backends (audin mac.m, audin ios.m). The issue occurs during the calculation of the audio queue buffer size using the formula `FramesPerPacket * 2 * nChannels` in UINT32 arithmetic. A malicious RDP server can send a `FramesPerPacket` value of 2^30 in the audin Open PDU to cause the multiplication to wrap. This results in undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients. **Recommendations** Update FreeRDP to version 3.32.0.