CVE-2026-111380CWE-190

CVE-2026-111380

High · published October 16, 2026

CVSS v3.1

8.8

EPSS

Percentile

16.5

In the wild

Unconfirmed

What it is

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.

The record

Technical detail

CVSS v3.1: 8.8 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0: 8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS: 0.00257 · 16.5th percentile
Weakness: CWE-190 · Integer Overflow or Wraparound
Published: 2026-10-16T07:18Z

Affected products (1)

Product	Versions	Fixed in
freerdp/freerdp	≥ 3.29.0, < 3.32.0	3.32.0

References (3)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf · [email protected]https://www.vulncheck.com/advisories/freerdp-3.29.0-before-3.32.0-heap-overflow-via-audin-apple-backends · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-72qv-gcph-rfwf · 134c704f-9b21-4f2e-91b3-4a467353bcc0

EPSS history

Timeline

17 OCT 03:28Z
EPSS moved — → 0%
epss
16 OCT 01:17Z
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
cvelistv5
16 OCT 01:17Z
FreeRDP 3.29.0 before 3.32.0 Heap Overflow via audin Apple Backends
cvelistv5