Is CVE-2026-111380 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-111380?

CVE-2026-111380 has a CVSS v3 severity of HIGH (8.8).

Back

CVE-2026-111380

Description

FreeRDP from 3.29.0 before 3.32.0 contains an integer overflow in the Apple audin backends (audin_mac.m, audin_ios.m), which compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic, bypassing the CVE-2026-91962 fix. A malicious RDP server can send FramesPerPacket of 2^30 in the audin Open PDU to wrap the multiplication, causing undersized AudioQueueAllocateBuffer allocations and a heap out-of-bounds write in macOS and iOS clients.