CVE-2026-111380: FreeRDP Integer Overflow Bypasses Prior Apple Audio Fix

Executive Summary

A newly disclosed FreeRDP vulnerability, CVE-2026-111380, re-opens a bug that an earlier patch was supposed to have closed. The flaw lives in the Apple audio input (audin) backends — audin_mac.m for macOS and audin_ios.m for iOS clients — and allows a malicious RDP server to trigger a heap-based out-of-bounds write on a connecting client, with no authentication required.

CVSS Score: 8.8 (High)

The project has fixed the issue in FreeRDP 3.32.0. There is no indication of in-the-wild exploitation yet, but the bug is remotely triggerable and the fix it bypasses (CVE-2026-91962) was only months old, making this a priority patch for any macOS or iOS environment running FreeRDP-based RDP clients.

Vulnerability Overview

Root Cause

FreeRDP's Apple audio input backends compute the size of an audio queue buffer using the formula FramesPerPacket * 2 * nChannels, performed entirely in 32-bit unsigned integer (UINT32) arithmetic. A remote RDP server controls the FramesPerPacket value via the audio redirection channel's Open PDU.

By sending a crafted FramesPerPacket value close to 2³⁰, the multiplication overflows and wraps around to a small number. FreeRDP then allocates an audio buffer sized according to that wrapped (undersized) value via AudioQueueAllocateBuffer, while the client continues writing audio data sized to the attacker-controlled, pre-overflow value — producing a heap out-of-bounds write once playback begins.

A Fix That Didn't Fully Fix It

This is the second time this exact code path has needed patching:

The earlier fix addressed one arithmetic path but left the FramesPerPacket * 2 * nChannels computation exploitable through a different input combination — a reminder that integer-overflow patches need to validate every operand in a multiplication chain, not just the one that triggered the original report.

Details

How the Attack Works

1. A victim connects to an RDP server using a FreeRDP-based client built with the Apple audio input backend enabled (macOS or iOS).
2. The server sends an audio redirection Open PDU with a FramesPerPacket value set to roughly 2³⁰.
3. FreeRDP computes the required buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic. The multiplication overflows and wraps to a small value.
4. AudioQueueAllocateBuffer allocates a buffer sized to the wrapped (small) value.
5. When subsequent audio data is written into the undersized buffer at the size the server originally implied, the write runs past the allocation — a classic heap out-of-bounds write.

Because the trigger is entirely server-controlled and requires no client-side interaction beyond an established RDP session, any organization that connects to third-party or untrusted RDP endpoints from a macOS or iOS FreeRDP client is exposed.

Who Is Affected

• FreeRDP client builds from 3.29.0 up to 3.31.x that include the Apple audin backend — this covers macOS and iOS FreeRDP-based clients, including downstream apps that embed the FreeRDP library for RDP connectivity.
• Builds that do not compile in the Apple audio backend, or environments where audio redirection is disabled, are not affected by this specific code path.
• Server-side FreeRDP deployments are not directly affected; the risk sits with clients connecting outward to a server that could be malicious or compromised.

Remediation

1. Upgrade to FreeRDP 3.32.0 or later on any macOS or iOS client build. This is the only complete fix, since it closes the gap left by the CVE-2026-91962 patch.
2. If an immediate upgrade isn't possible, disable audio redirection (the audin channel) for RDP sessions from affected clients as a temporary mitigation.
3. Audit any downstream application that statically links or vendors FreeRDP — the vulnerable code ships inside the library, so app-level version numbers won't tell you whether the fix is present.
4. Restrict outbound RDP connections to known, trusted servers where feasible, since exploitation requires control of (or a foothold on) the RDP server side.

Key Takeaways

1. CVE-2026-111380 is a second overflow in the same FreeRDP Apple audio buffer-size calculation that CVE-2026-91962 was supposed to have fixed back in version 3.31.0.
2. Exploitation requires only a malicious RDP server sending a crafted FramesPerPacket value — no user interaction, no authentication.
3. The impact is a heap out-of-bounds write, which the FreeRDP project and NVD rate as capable of memory corruption, denial of service, and likely remote code execution.
4. FreeRDP 3.32.0 contains the complete fix; disabling audio redirection is a viable short-term mitigation for clients that cannot upgrade immediately.

Sources

• NVD — CVE-2026-111380
• FreeRDP Security Advisory GHSA-72qv-gcph-rfwf
• Strix AI — CVE-2026-111380 Analysis