CVE-2026-111380

Name of the Vulnerable Software and Affected Versions FreeRDP versions 3.29.0 through 3.31.0

Description An integer overflow exists in the Apple audin backends (audin mac.m, audin ios.m). The issue occurs during the calculation of the audio queue buffer size using the formula FramesPerPacket * 2 * nChannels in UINT32 arithmetic. A malicious RDP server can send a FramesPerPacket value of 2^30 in the audin Open PDU to cause the multiplication to wrap. This results in undersized AudioQueueAllocateBuffer allocations, leading to a heap out-of-bounds write in macOS and iOS clients.

Recommendations Update FreeRDP to version 3.32.0.