CVE-2026-91962 FreeRDP CVE debrief

Who should care

Defenders and administrators using FreeRDP should assess exposure and prioritize patching to version 3.31.0 or later. The vulnerability has a medium severity with a CVSS score of 5.3, and successful exploitation requires crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap. Affected operators, platforms, and security teams should review the supplied official advisory or CVE record to validate affected scope, severity,

Why it matters

CVE-2026-91962 is a medium-severity vulnerability in FreeRDP that can lead to potential out-of-bounds access due to an integer overflow in audin Apple backends. Defenders and administrators using FreeRDP should assess exposure, prioritize patching to version 3.31.0 or later, and verify inventory for systems using vulnerable versions.

• Potential out-of-bounds access due to undersized buffer allocation
• Need to verify inventory for systems using vulnerable FreeRDP versions
• Requires patching to version 3.31.0 or later for mitigation

Technical summary

FreeRDP before 3.31.0 has an integer overflow in audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. This can lead to undersized buffer allocation and potential out-of-bounds access. The vulnerability is caused by the lack of proper validation of FramesPerPacket values, which can cause the AudioQueueAllocateBuffer size computation to wrap. Defenders and administrators using FreeRDP should assess exposure and prioritize patching to version 3.31.0 or later. The vulnerability has a medium severity with a CVSS score of 5.3.

Defensive priority

Assess exposure, prioritize patching

Recommended defensive actions

• Assess exposure to vulnerable FreeRDP versions
• Prioritize patching to version 3.31.0 or later
• Verify inventory for systems using FreeRDP
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

FreeRDP before 3.31.0 contains an integer overflow in audin Apple backends. Attackers can supply crafted FramesPerPacket values causing AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer allocation and potential out-of-bounds access.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.