CVE-2026-68580: 
Wolfi vulnerability analysis and mitigation

CVE-2026-68580 is an integer overflow vulnerability (CWE-122: Heap-based Buffer Overflow) in FreeRDP's audio input redirection channel (audin) affecting all versions before 3.29.0. The flaw exists across four audio backends — ALSA (Linux), sndio (BSD), WinMM (Windows), and OpenSL ES (Android) — and stems from the failure to validate the FramesPerPacket parameter received from RDP servers. Discovered by researcher Ömer Can VURAL and reported on 2026-07-12, the vulnerability was publicly disclosed on 2026-08-02 via a coordinated advisory. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 7.7 (High) (FreeRDP Advisory, Github Advisory).

The root cause is the absence of any bounds check on the FramesPerPacket parameter (a UINT32) delivered by an RDP server via the MSG_SNDIN_OPEN protocol message (MS-RDPEAI §2.2.2.2). Each backend's SetFormat implementation stores this attacker-controlled value directly into the per-device structure, which is then used in allocation size arithmetic performed in 32-bit (or narrower) integer types — causing wraparound before the result is widened to size_t. In the ALSA backend (audin_alsa.c:143), the expression calloc(frames_per_packet + nBlockAlign, bytes_per_frame) overflows: with FramesPerPacket=0xFFFFFFFF and nBlockAlign=4, the sum wraps to 3, allocating only 12 bytes, while snd_pcm_readi() is separately called with the original unoverflowed value of ~4.3 billion frames — a textbook heap-based buffer overflow confirmed via AddressSanitizer. The sndio, WinMM, and OpenSL ES backends suffer multiplication-based overflows that result in denial of service rather than heap overflow, because both the allocation size and the I/O read count use the same overflowed value. Exploitation requires the victim to connect to a malicious or compromised RDP server with audio input redirection enabled, or an attacker to hold a post-TLS-handshake MITM position (FreeRDP Advisory).

On Linux systems using the ALSA backend, successful exploitation results in a heap-based buffer overflow that can enable arbitrary code execution as the FreeRDP client process, with potential for full confidentiality, integrity, and availability compromise of the affected system. On all other platforms (BSD/sndio, Windows/WinMM, Android/OpenSL ES), the overflow causes denial of service through audio channel failure or allocator crash. The vulnerability is client-side only and does not affect FreeRDP server deployments; however, a compromised or malicious RDP server can silently trigger it against any connecting client with audio input redirection active (FreeRDP Advisory, Github Advisory).

1. Set up a malicious RDP server: Deploy a rogue RDP server (e.g., a modified FreeRDP server build or a custom implementation) that the attacker controls, capable of sending crafted MSG_SNDIN_OPEN messages with arbitrary FramesPerPacket values.
2. Lure the victim to connect: Social-engineer the target into connecting to the malicious RDP server using a FreeRDP client (version < 3.29.0) with audio input redirection enabled (e.g., via /microphone:sys:alsa flag on Linux).
3. Complete the RDP handshake: Allow the standard RDP authentication and virtual channel negotiation to complete, establishing the audin dynamic virtual channel pipeline.
4. Send crafted MSG_SNDIN_OPEN: Transmit a MSG_SNDIN_OPEN message (Message Type 0x01, MS-RDPEAI §2.2.2.2) with FramesPerPacket set to 0xFFFFFFFF (or another value that causes wraparound given the target's audio format parameters).
5. Trigger integer overflow in ALSA backend: The FreeRDP client stores the value without validation; the audio capture thread computes calloc(0xFFFFFFFF + nBlockAlign, bytes_per_frame), which wraps to a tiny allocation (e.g., 12 bytes).
6. Achieve heap buffer overflow: snd_pcm_readi() is called with the original unoverflowed frame count (~4.3 billion frames), writing far beyond the 12-byte heap allocation and corrupting adjacent heap memory.
7. Achieve code execution (theoretical): Leverage heap layout manipulation techniques to control the overflow and redirect execution to attacker-controlled code running as the FreeRDP client process (FreeRDP Advisory).

• Network: Outbound RDP connections (TCP/3389 or custom port) from client systems to unknown or untrusted RDP server IP addresses; MSG_SNDIN_OPEN messages with anomalously large FramesPerPacket values in RDP traffic captures.
• Process: FreeRDP client process (xfreerdp, wlfreerdp) crashing unexpectedly or spawning unexpected child processes; abnormal memory usage or segmentation faults in the FreeRDP process.
• Logs: Application crash logs or core dumps from FreeRDP with stack traces referencing audin_alsa_thread_func, snd_pcm_readi, or calloc in audin_alsa.c; AddressSanitizer-style heap-buffer-overflow reports if instrumented builds are in use.
• File System: Unexpected core dump files (e.g., core, core.<pid>) in the working directory of the FreeRDP process; new or modified files created by the FreeRDP process user account following a crash.

Upgrade FreeRDP to version 3.29.0 or later, which contains fixes for all four integer overflow vulnerabilities in the audin channel backends (FreeRDP Advisory). If immediate patching is not possible, disable audio input redirection by omitting the /microphone flag when launching FreeRDP clients, which prevents the vulnerable audin channel from being negotiated. Additionally, restrict RDP connections to trusted, verified servers only, enforce NLA (Network Level Authentication) and validate TLS certificates to prevent MITM-based exploitation.