FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue…
FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.
Read at NIST National Vulnerability Database (CVE API 2.0)
- Vendor
- Apple
- Product
- ios, macos
- CVSS
- 8.8
- EPSS
- 0.003 (p25)
- Exposure class
- Remote access, Mobile OS, Operating system
Why it ranks 28 (Notable)
- CVSS 8.8 high
- Exposed product class: remote access
- Widely deployed vendor product (Apple)
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.