CVE-2026-111380 Overview
CVE-2026-111380 is an integer overflow vulnerability [CWE-190] in FreeRDP affecting versions 3.29.0 through versions prior to 3.32.0. The flaw resides in the Apple audio input (audin) backends, specifically audin_mac.m and audin_ios.m. These backends compute the audio queue buffer size as FramesPerPacket * 2 * nChannels using UINT32 arithmetic, which bypasses the earlier fix introduced for CVE-2026-91962. A malicious Remote Desktop Protocol (RDP) server can exploit this condition to trigger a heap out-of-bounds write in macOS and iOS clients that connect to it.
Critical Impact
A malicious RDP server can cause undersized AudioQueueAllocateBuffer allocations and subsequent heap out-of-bounds writes on connecting macOS and iOS FreeRDP clients, enabling memory corruption that may lead to arbitrary code execution.
Affected Products
- FreeRDP 3.29.0 through versions prior to 3.32.0
- FreeRDP macOS clients using the audin_mac.m backend
- FreeRDP iOS clients using the audin_ios.m backend
Discovery Timeline
- 2026-10-16 - CVE-2026-111380 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-111380
Vulnerability Analysis
The vulnerability stems from unsafe integer arithmetic in FreeRDP's Apple audin backend. When processing an audin Open Protocol Data Unit (PDU) from the RDP server, the code multiplies attacker-controlled fields together without validating against overflow. The multiplication FramesPerPacket * 2 * nChannels is performed in UINT32, which wraps when operands are large. This bypasses the mitigation applied for CVE-2026-91962, which did not account for arithmetic in the Apple-specific backends.
The wrapped result is passed to AudioQueueAllocateBuffer, producing an undersized heap allocation. Subsequent audio frame writes exceed the allocated buffer, corrupting adjacent heap metadata and objects. Successful exploitation requires a victim user to connect to an attacker-controlled RDP endpoint, which satisfies the user interaction requirement in the vulnerability's attack profile.
Root Cause
The root cause is an integer overflow [CWE-190] in UINT32 arithmetic used to size an audio queue buffer. The code paths in audin_mac.m and audin_ios.m trust server-supplied FramesPerPacket and nChannels values without range checks or saturated arithmetic. Supplying FramesPerPacket of 2^30 wraps the product to a small value, breaking the invariant that the allocation size matches the actual byte count written during audio ingestion.
Attack Vector
Exploitation requires a user to initiate an RDP session to a malicious server, typically through social engineering or a redirection scenario. The server sends a crafted audin Open PDU containing oversized frame and channel values. The FreeRDP client allocates an undersized buffer, then writes audio sample data beyond the allocation boundary, corrupting heap memory on the macOS or iOS host.
See the GitHub Security Advisory GHSA-72qv-gcph-rfwf and the VulnCheck FreeRDP Heap Overflow Advisory for additional technical detail.
Detection Methods for CVE-2026-111380
Indicators of Compromise
- Unexpected crashes or memory corruption signatures in FreeRDP processes (xfreerdp, wfreerdp, iOS/macOS client binaries) after RDP sessions to untrusted hosts.
- Outbound RDP connections (TCP 3389) from macOS or iOS endpoints to unknown or newly observed external hosts.
- Audin channel negotiation events immediately followed by client-side process termination or heap allocator diagnostics.
Detection Strategies
- Inspect RDP traffic for audin Open PDUs containing unusually large FramesPerPacket values, particularly values near or above 2^30.
- Monitor FreeRDP client telemetry for abnormal exits, sanitizer reports, or crash logs correlated with active RDP sessions.
- Correlate macOS and iOS endpoint crash reports referencing AudioQueueAllocateBuffer with recent RDP activity to identify exploitation attempts.
Monitoring Recommendations
- Alert on first-seen outbound RDP destinations from Apple endpoints and apply allow-listing for sanctioned RDP servers.
- Capture and retain FreeRDP version inventory across macOS and iOS fleets to prioritize remediation of vulnerable 3.29.0–3.31.x installs.
- Log Dynamic Virtual Channel (DVC) negotiations to flag AUDIO_INPUT channel openings from unexpected servers.
How to Mitigate CVE-2026-111380
Immediate Actions Required
- Upgrade FreeRDP to version 3.32.0 or later on all macOS and iOS clients.
- Restrict outbound RDP connectivity from Apple endpoints to a curated list of trusted servers.
- Audit distributed FreeRDP binaries and third-party RDP clients that embed FreeRDP for the vulnerable version range.
Patch Information
FreeRDP has released version 3.32.0, which corrects the integer overflow in the Apple audin backends. Refer to the GitHub Security Advisory GHSA-72qv-gcph-rfwf for patch details and backport guidance. Downstream distributors of FreeRDP for macOS and iOS should rebuild and redistribute client applications against the fixed release.
Workarounds
- Disable the audin dynamic virtual channel at session startup by omitting the audio input redirection option when invoking the FreeRDP client.
- Limit RDP use to internal, trusted servers until clients are upgraded to 3.32.0 or later.
- Enforce network egress policies that block RDP traffic from macOS and iOS endpoints to arbitrary internet destinations.
# Launch FreeRDP without the audio input channel to avoid the vulnerable audin backend
xfreerdp /v:trusted.rdp.server.internal /u:username -audio-mode:0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
