CVE-2026-91962

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description An integer overflow exists in the audin Apple backends when processing FramesPerPacket values from MSG SNDIN OPEN messages. An attacker can provide crafted FramesPerPacket values that cause the size computation in the AudioQueueAllocateBuffer() function to wrap. This leads to the allocation of an undersized buffer, which may result in out-of-bounds access. Real-world incidents indicate this issue has been exploited in the wild.

Recommendations Update FreeRDP to version 3.31.0 or later.