CVE-2026-111380
Freerdp: integer overflow
- Risk score
- 68/100
- CVSS
- 8.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 16 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audi…
- Affected
- Freerdp before 3.32.0
- Fix
- Upgrade Freerdp to 3.32.0 or later.
- Exploitation
- Public proof of concept
Story map
At a glance
Freerdp: Amber, patch this week. FreeRDP from 3.0.0 before 3.32.0 contains an out-of-bounds read vulnerability in the Windows RAIL client that allows malicious RDP servers to trigger heap over-reads by sending non-NUL-terminated window titles. Attackers can send a full-length WINDOW_ORDER_FIELD_TITLE update that wf_rail_window_common passes to SetWin…
The flaws
- CVE-2026-111380: Integer overflow (CVSS 8.8 · EPSS 0%)
- CVE-2026-111375: Out-of-bounds read can lead to denial of service (CVSS 9.1 · EPSS 0%)
- CVE-2026-111382: Out-of-bounds write can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-111378: Denial of service (CVSS 7.5 · EPSS 1%)
The fix
Upgrade Freerdp: 3.32.0 or later on your release line
Who is exposed: Freerdp before 3.32.0
Where it stands
- Public proof of concept
Connects to
- Same weakness: Integer overflow (CWE-190). 125 other warnings in 30 days
- Same product: Earlier Freerdp warnings. 29 in the last 90 days
Why it is Amber
- CVSS 8.8 high
- Public exploit or proof of concept referenced
- Remotely exploitable without logging in
References
Original description
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
Last activity 16 Oct 2026. Patch Forecast updates every hour.