CVE-2026-111380 is a High severity (CVSS 8.8) integer overflow in FreeRDP from 3.29.0 before 3.32.0. The macOS and iOS audio input code can allocate a buffer that is too small for data from a malicious RDP server. Upgrade to FreeRDP 3.32.0, the fixed release.
What's affected
The record says FreeRDP from 3.29.0 before 3.32.0 is affected. The GitHub advisory lists affected versions as 3.31.0 and earlier and patched version 3.32.0. The record narrows the range to start at 3.29.0. The advisory is labelled High. The weakness is CWE-190, integer overflow or wraparound.
According to the advisory, this is a bypass of the fix for CVE-2026-91962. That fix rejected large FramesPerPacket values in the shared audio input code. The Apple backends, audin_mac.m and audin_ios.m, then multiply the value by 2 and by the channel count in 32-bit unsigned arithmetic. Some values that pass the earlier check still wrap, and AudioQueueAllocateBuffer gets a size that is too small, leading to a heap write past the buffer.
The record describes a malicious RDP server as the attacker, and says macOS and iOS clients are the targets. Severity differs by source. The record gives 8.8 (High), and VulnCheck lists 8.7 on a CVSS 4.0 vector. The record names only the Apple backends.
How to check if you're exposed
Check the FreeRDP version your clients use.
xfreerdp /version
On macOS, check applications that bundle FreeRDP, since they may carry their own copy. Versions from 3.29.0 through 3.31.0 are in range. For package managers, check what you installed.
brew list --versions freerdp
The vulnerable code is only in the audio input path for Apple platforms. If you build FreeRDP yourself, check whether audio input redirection is compiled in and used. The free in-browser dependency scan at gold.safeguard.sh/scan can match a manifest or lockfile against known CVEs without installing anything.
What to do now
- Upgrade FreeRDP to 3.32.0 or later on macOS and iOS clients, and rebuild applications that bundle it.
- Only connect to RDP servers you trust, and verify server certificates.
- If you cannot upgrade yet, disable audio input redirection in the client where your use allows it.
- Ask vendors of RDP clients built on FreeRDP whether they have shipped 3.32.0 or a backport.
- Track the earlier CVE-2026-91962 in your inventory too, since this one bypasses its fix.
Why it matters
This is a textbook incomplete fix. The first patch limited a value to below a signed 32-bit maximum, but a later calculation multiplies that value, so a number that passes the check can still overflow. A guard needs to match how the value is used, not only its type.
RDP clients process data from servers that may be compromised or malicious, which makes client side memory bugs relevant. The record needs a user to connect to the hostile server. The record does not mark this CVE as known exploited, and none of the pages we read say it is.
Quick check
Which FreeRDP version fixes CVE-2026-111380?
3.32.0, according to the GitHub advisory.
Does this affect Windows or Linux clients?
The record and advisory describe the Apple audio input backends, and name macOS and iOS clients as the targets.
Sources
Last reviewed: 18 October 2026.
