CVE-2026-111380: 
Wolfi vulnerability analysis and mitigation

CVE-2026-111380 is an integer overflow vulnerability in FreeRDP's Apple audio input (audin) backends that enables heap out-of-bounds write, potentially leading to arbitrary code execution on macOS and iOS clients. It affects FreeRDP versions 3.29.0 through 3.31.x and was disclosed on October 16, 2026. The vulnerability is a bypass of a prior fix for CVE-2026-91962, as the incomplete patch in audin_main.c did not address the same arithmetic flaw in the Apple-specific backends (audin_mac.m, audin_ios.m). It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory, FreeRDP Advisory).

The root cause is an integer overflow (CWE-190) leading to an out-of-bounds write (CWE-787) in the Apple audin backends. The prior fix for CVE-2026-91962 added a guard in audin_main.c rejecting FramesPerPacket >= INT32_MAX, but the Apple backends (audin_mac.m:277, audin_ios.m:245) still compute the audio queue buffer size as FramesPerPacket * 2 * nChannels in UINT32 arithmetic without overflow protection. A malicious RDP server can send FramesPerPacket = 2^30 (1,073,741,824) in the audin Open PDU — a value that passes the INT32_MAX guard — causing the multiplication 1,073,741,824 × 2 × 2 = 4,294,967,296 to wrap to 0 in 32-bit unsigned arithmetic, resulting in a zero- or undersized AudioQueueAllocateBuffer allocation. Subsequent audio capture callbacks then write gigabytes of audio data into this undersized buffer, producing a heap out-of-bounds write (FreeRDP Advisory).

Successful exploitation allows an attacker-controlled RDP server to trigger a heap out-of-bounds write in the FreeRDP client process on macOS and iOS, with high impact to confidentiality, integrity, and availability. This can result in client-side arbitrary code execution in the context of the FreeRDP process, potential memory disclosure, and application crash. The impact is scoped to the vulnerable client system; however, code execution could enable further lateral movement or data exfiltration from the affected endpoint (FreeRDP Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit or evidence of in-the-wild exploitation at this time, and the CVE is not listed in the CISA KEV catalog (GitHub Advisory). The EPSS score is 0.0, reflecting low current exploitation probability. Exploitation requires the victim to connect to a malicious RDP server, but no additional client-side interaction is needed beyond initiating the connection, as the server controls the audin channel negotiation. The advisory includes a PoC arithmetic demonstration confirming the overflow behavior on macOS Darwin 25.3.0 arm64 (FreeRDP Advisory).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server capable of advertising the audin (audio input) virtual channel and crafting arbitrary audin Open PDU fields.
2. Lure the victim to connect: Social-engineer or redirect a macOS or iOS FreeRDP client (versions 3.29.0–3.31.x) to connect to the attacker-controlled RDP server.
3. Advertise the audin channel: During RDP session negotiation, advertise support for the audin virtual channel to trigger the client's Apple audio backend initialization.
4. Send crafted audin Open PDU: Transmit an audin Open PDU with FramesPerPacket set to 2^30 (1,073,741,824). This value passes the INT32_MAX guard in audin_main.c but causes UINT32 overflow in the Apple backend buffer size calculation (1,073,741,824 × 2 × 2 = 4,294,967,296, wrapping to 0).
5. Trigger undersized allocation: The client calls AudioQueueAllocateBuffer with a size of 0 (or a tiny value), which succeeds on macOS (returning a non-NULL pointer).
6. Achieve heap out-of-bounds write: When the audio capture callback fires, it writes approximately 4 GB of audio data into the 0-byte or undersized buffer, corrupting the heap and potentially enabling arbitrary code execution in the FreeRDP client process (FreeRDP Advisory).

• Network: Outbound RDP connections (TCP port 3389) from macOS or iOS endpoints to unfamiliar or untrusted RDP server IP addresses; audin virtual channel negotiation traffic in RDP sessions to external hosts.
• Process: FreeRDP client process (xfreerdp, freerdp) crashing unexpectedly or generating crash reports on macOS/iOS after connecting to an RDP server; unusual child processes spawned by the FreeRDP process.
• Logs: macOS crash reports (~/Library/Logs/DiagnosticReports/) referencing FreeRDP with heap corruption or out-of-bounds write stack traces; system log entries (/var/log/system.log) showing abnormal termination of FreeRDP with signal 11 (SIGSEGV) or signal 6 (SIGABRT).
• File System: Unexpected core dump files in the FreeRDP working directory following RDP sessions to untrusted servers.

Update FreeRDP to version 3.32.0 or later, which contains the fix for this vulnerability (GitHub Advisory, FreeRDP Advisory). Until patching is possible, avoid connecting to untrusted or unknown RDP servers from macOS or iOS FreeRDP clients, and consider disabling the audin virtual channel if audio input redirection is not required. Network-level controls restricting RDP connections to only trusted, known-good servers can reduce exposure.

The vulnerability was reported by researcher thawkhant and published by FreeRDP maintainer akallabeth via a GitHub Security Advisory on October 1, 2026, with the CVE formally assigned and published on October 16, 2026 (FreeRDP Advisory). Red Hat opened a tracking bug (Bugzilla #2553925) classifying the issue as high severity for the freerdp package (Red Hat Bugzilla). No significant broader media coverage or notable social media commentary has been identified at this time.