Executive brief
FreeRDP is a popular open-source remote desktop client used by organizations to connect to Windows machines. A vulnerability in its audio input handling allows a malicious RDP server to send crafted values that cause integer overflow during buffer allocation, potentially resulting in undersized memory buffers. An attacker controlling an RDP server could exploit this to access memory beyond the allocated buffer, potentially compromising the confidentiality and integrity of the connecting client's data.
Technical details
This vulnerability is an integer overflow (CWE-190) in the audin (audio input) Apple backends (macOS and iOS) of FreeRDP. The vulnerability occurs in the buffer size calculation: FramesPerPacket * 2 * nChannels, where FramesPerPacket is read from a server-controlled MSG_SNDIN_OPEN message. Although audin_process_open() checks that FramesPerPacket < INT32_MAX, carefully crafted values (e.g., 0x40000001) can still cause unsigned integer wraparound when multiplied by 2 and nChannels, resulting in a very small allocation size instead of the intended large buffer. The malicious RDP server must be network-reachable by the client; no user interaction is required beyond initiating an RDP connection. The wrapped allocation can succeed with a drastically undersized buffer, enabling potential out-of-bounds memory access during subsequent audio buffer operations. The issue was patched in FreeRDP 3.31.0 by applying checked arithmetic and rejecting unreasonable FramesPerPacket/channel combinations, aligning the Apple backends with protections added to other audin backends.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory (GHSA-f5p6-88mh-59vg) published
- 2026-09-15: advisory: CVE-2026-91962 published on NVD
- 2026: patched: Fixed in FreeRDP 3.31.0