CVE-2026-111380 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP deployments, particularly those using macOS and iOS clients, should assess exposure and prioritize patching. This includes reviewing and updating affected systems, monitoring for suspicious activity, and verifying FreeRDP versions.

Why it matters

CVE-2026-111380 FreeRDP integer overflow vulnerability requires verification and patching to prevent potential heap out-of-bounds writes in macOS and iOS clients.

• Potential heap out-of-bounds write in macOS and iOS clients
• Requires verification of FreeRDP versions and patching
• May impact systems using affected FreeRDP versions

Technical summary

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients. This vulnerability requires verification and patching to prevent potential heap out-of-bounds writes.

Defensive priority

Defenders should prioritize verifying FreeRDP versions and applying patches to prevent potential heap out-of-bounds writes.

Recommended defensive actions

• Verify FreeRDP version and apply patches
• Review and update affected systems
• Monitor for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record and NVD entry provide details on the integer overflow vulnerability in FreeRDP. However, the corpus lacks specific information on affected versions and exploitation. The vulnerability was disclosed on 2026-10-16T03:18:05.123Z. FreeRDP versions 3.29.0 to 3.31.0 are affected. The CVE Program and NVD provide official details on this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.