Executive brief
FreeRDP is a widely-used remote desktop client that allows users to connect to Windows computers and other systems remotely. A flaw in its audio input feature permits attackers who control a malicious RDP server to cause the client to crash (denying service) or potentially execute arbitrary code on Linux systems running FreeRDP. This could allow an attacker to compromise a user's computer or steal sensitive data during a remote session.
Technical details
The vulnerability is an integer overflow in the audio input redirection (audin) channel affecting multiple audio backends (ALSA on Linux, sndio on BSD, WinMM on Windows, and OpenSL ES on Android). The flaw occurs because the FramesPerPacket parameter received from an RDP server via MSG_SNDIN_OPEN or MSG_SNDIN_FORMATS messages is not validated before use in allocation size calculations. A malicious server can supply a crafted FramesPerPacket value causing integer wraparound, resulting in undersized heap buffer allocations. On ALSA backends, the overflowed allocation size combined with the original frame count in the audio read operation produces a direct heap-based buffer overflow (CWE-122). On other backends, the overflow propagates to both allocation and I/O calls, resulting in denial of service. Exploitation requires a user to connect to an attacker-controlled RDP server, but no user interaction beyond initiating the connection is needed. The vulnerability is patched in FreeRDP 3.29.0 and later.
Affected products
- FreeRDP FreeRDP before 3.29.0
Timeline
- 2026-07-20: disclosed
- 2026-08-02: advisory
- 2026-08-02: patched: Fixed in version 3.29.0