CVE-2026-111380High· 8.8▾ TwilightFreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
FreeRDP >= 3.29.0 < 3.32.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-109938Medium· 6.5Positive mapped-video coordinates overflow and abort FreeRDP clients A malicious or compromised RDP server can terminate a FreeRDP client after the user connects with video redirection enabled.
CVE-2026-91960Medium· 6.5FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service
CVE-2026-55191Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-55648High· 7.5FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-111377Medium· 6.5FreeRDP 2.0.0 before 3.32.0 Memory Exhaustion via Static Channel Reassembly
CVE-2026-111376Medium· 5.0FreeRDP 3.30.0 before 3.32.0 Heap Over-Read via Windows cliprdr FILECONTENTS_SIZE