CVE-2026-111380
8.8HighPublished 16 Oct 2026 · NVD status: Undergoing Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Full C/I/A compromise
- Weakness
- CWE-190
Impact
A malicious RDP server can achieve remote code execution or crash macOS and iOS clients via a heap overflow. The attacker needs a user to connect to their rogue or compromised RDP server with audio input enabled.
Root cause
An integer overflow in 32-bit arithmetic during audio buffer size calculation leads to undersized memory allocations and a subsequent heap out-of-bounds write.
Affected systems
FreeRDP 3.29.0 before 3.32.0 on macOS and iOS
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade FreeRDP to version 3.32.0 or later. If patching immediately is not possible, disable audio input redirection in the client connection settings.
$ brew upgrade freerdpAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.