CVE-2026-91962
Received Received - Intake

Integer Overflow in FreeRDP Audin Backend

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer allocation and potential out-of-bounds access.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91962
EUVD
EUVD-2026-78638

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.31.0 has an integer overflow flaw in its audin Apple backends. When processing FramesPerPacket values from MSG_SNDIN_OPEN messages, attackers can send specially crafted values that cause the AudioQueueAllocateBuffer size calculation to wrap around. This results in allocating buffers that are too small, potentially leading to out-of-bounds memory access.

Detection Guidance

To detect this vulnerability, check the FreeRDP version on your system. Run: freerdp2-shadow --version or apt list --installed | grep freerdp. If the version is less than 3.31.0, the system is vulnerable. Monitor network traffic for RDP connections attempting to negotiate audin parameters.

Impact Analysis

If you use FreeRDP versions before 3.31.0, a malicious RDP server could exploit this to cause memory corruption. This might lead to crashes, data corruption, or even arbitrary code execution on your system during audio stream processing.

Mitigation Strategies

Immediately update FreeRDP to version 3.31.0 or later. If updating is not possible, disable the audin feature in FreeRDP by removing or disabling the Apple audio backend modules. Restrict RDP server access to trusted networks only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91962. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart