High priorityDisclosed

Advisory · CVE-2026-111380

FreeRDP Apple audio channel overflow bypasses an earlier fix

FreeRDP clients on macOS and iOS before 3.32.0 compute an audio buffer size in 32-bit arithmetic, so a malicious RDP server can wrap the size and trigger a heap out-of-bounds write. CVSS 3.1 8.8.

Advisory published October 16, 2026Independent summary
Vendor
FreeRDP
Product
FreeRDP
Identifier / CWE
CVE-2026-111380
CWE-190
Action timing
Immediate
ELI5

Explain it like I’m five

The Mac and iPhone versions do the buffer-size maths in a small calculator that rolls over to near zero, so a hostile server gets a tiny buffer and then writes far past it.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Client connects

    A user connects a FreeRDP client on macOS or iOS to a malicious or compromised RDP server.

  2. 02Crafted audio value sent

    The server sends an Audio Input PDU with a very large FramesPerPacket value.

  3. 03Guard passed, size wraps

    The value passes the existing INT32_MAX guard, but the Apple backends multiply it in UINT32 arithmetic and the result wraps to a tiny size.

  4. 04Undersized buffer filled

    AudioQueueAllocateBuffer allocates the wrapped size and subsequent audio handling writes beyond it on the client heap.

What happened

The GitHub advisory for FreeRDP describes CVE-2026-111380 as a bypass of the earlier fix for CVE-2026-91962. That fix rejects very large FramesPerPacket values in the shared audio input code, but the Apple backends in audin_mac.m and audin_ios.m were left unchanged.

Those backends compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic. Values that pass the guard can still wrap the multiplication to 0 or a tiny size, producing undersized AudioQueueAllocateBuffer allocations and the same heap out-of-bounds write the original fix was meant to prevent. The NVD listing places affected releases from 3.29.0 before 3.32.0.

The flaw is client-side: the attacker controls or compromises the RDP server a victim connects to, and the overflow happens on the macOS or iOS client when the audio input channel is used.

What to do

  1. Inventory FreeRDP clients on macOS and iOS, including builds bundled inside other remote access tools.
  2. Upgrade affected clients to FreeRDP 3.32.0 or later using the project release guidance.
  3. Until clients are patched, avoid connecting to untrusted RDP servers and consider disabling the audio input channel where it is not needed.
  4. Review crash reports on Apple endpoints for faults in the audio queue path after sessions with unfamiliar servers.
  5. Verify the deployed client version after the upgrade.

Management note

A patch that fixes the shared code path but misses platform backends is a recurring failure mode. Fleet checks should confirm the actual client build in use on Apple devices, not just that a FreeRDP update was issued somewhere.