CVE-2026-91962 Overview
CVE-2026-91962 is an integer overflow vulnerability [CWE-131] in FreeRDP versions before 3.31.0. The flaw resides in the audin Apple backends when processing FramesPerPacket values received in MSG_SNDIN_OPEN messages. A crafted FramesPerPacket value causes the size computation passed to AudioQueueAllocateBuffer to wrap around. The resulting allocation is undersized, enabling out-of-bounds memory access during audio buffer operations. FreeRDP is a widely used open-source implementation of the Remote Desktop Protocol (RDP) that ships in numerous Linux and macOS remote-access tools. Exploitation requires a user to connect to an attacker-controlled or compromised RDP server.
Critical Impact
A malicious RDP server can trigger undersized audio buffer allocations on connecting FreeRDP clients running on Apple platforms, leading to out-of-bounds memory access and potential client compromise.
Affected Products
- FreeRDP versions prior to 3.31.0
- FreeRDP audin channel Apple (macOS/iOS) audio backends
- Downstream applications embedding vulnerable FreeRDP builds on Apple platforms
Discovery Timeline
- 2026-09-15 - CVE-2026-91962 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91962
Vulnerability Analysis
The vulnerability affects the audio input (audin) channel handler in FreeRDP's Apple-specific backends. When an RDP server sends an MSG_SNDIN_OPEN message, the client parses a FramesPerPacket field describing the size of incoming audio frames. The Apple backend multiplies this value with per-frame sizing parameters to compute the buffer size passed to AudioQueueAllocateBuffer. Because the multiplication is performed without overflow checks, an attacker-supplied value can wrap the result to a small integer. The Core Audio framework then allocates a buffer far smaller than the code expects, while subsequent audio write operations proceed against the original larger logical size. This mismatch produces out-of-bounds memory access that can corrupt heap state within the FreeRDP client process.
Root Cause
The root cause is missing validation on untrusted FramesPerPacket input combined with unchecked integer arithmetic during buffer size calculation, matching the pattern described by CWE-131: Incorrect Calculation of Buffer Size.
Attack Vector
Exploitation requires a FreeRDP client on macOS or iOS to connect to a malicious or compromised RDP server. The server sends a crafted MSG_SNDIN_OPEN message over the audin dynamic virtual channel during session negotiation. User interaction is required to initiate the RDP connection. See the GitHub Security Advisory GHSA-f5p6-88mh-59vg and the VulnCheck Advisory on FreeRDP for further technical detail.
Detection Methods for CVE-2026-91962
Indicators of Compromise
- Unexpected FreeRDP client crashes on macOS or iOS shortly after initiating an outbound RDP session.
- Core Audio or AudioQueueAllocateBuffer errors logged by FreeRDP processes during session setup.
- Outbound RDP (TCP/3389) connections from developer or admin endpoints to untrusted or newly observed servers.
Detection Strategies
- Inventory hosts running FreeRDP binaries and compare installed versions against 3.31.0 or later.
- Alert on FreeRDP process crashes or abnormal termination events on macOS endpoints.
- Monitor audin dynamic virtual channel activity where telemetry is available.
Monitoring Recommendations
- Track outbound RDP connections from macOS assets and baseline expected destinations.
- Collect endpoint process, crash, and file integrity telemetry from macOS clients that use FreeRDP.
- Correlate RDP session initiation with subsequent unexpected child processes or memory-related faults.
How to Mitigate CVE-2026-91962
Immediate Actions Required
- Upgrade FreeRDP to version 3.31.0 or later on all Apple platforms.
- Rebuild and redistribute any downstream applications that statically link or embed FreeRDP.
- Restrict FreeRDP client connections to trusted RDP servers only.
Patch Information
The FreeRDP project addressed the integer overflow in release 3.31.0 by adding validation and safe multiplication around FramesPerPacket before invoking AudioQueueAllocateBuffer. Details are available in the GitHub Security Advisory GHSA-f5p6-88mh-59vg.
Workarounds
- Disable the audio input redirection (audin) channel in FreeRDP client configurations until patching is complete.
- Block outbound TCP/3389 traffic from macOS endpoints to untrusted networks via host or network firewall.
- Require RDP connections to traverse authenticated gateways that restrict server destinations.
# Disable audio input redirection when launching xfreerdp
xfreerdp /v:rdp.example.com -audio-mode:1 /audio-mode:0 -microphone
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
