Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-02T12:15:27 FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H CWE-190

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.

A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow, potentially enabling arbitrary code execution on systems using the ALSA backend, or a denial of service across all supported platforms.

This is a flaw in FreeRDP that could lead to remote code execution or denial of service on client systems. The vulnerability arises from an integer overflow in the audio input redirection channel (audin) when connecting to a malicious RDP server, which can cause a heap-based buffer overflow, particularly affecting Linux systems using the ALSA backend. Exploitation requires user interaction to connect to a compromised server. To mitigate this issue, disable the audio input redirection channel when using FreeRDP clients. This can be achieved by using the `/audin:no` command-line option when launching `xfreerdp` or other FreeRDP-based clients. Disabling audio input redirection may impact functionality that relies on microphone input during the RDP session. Ensure to restart any active FreeRDP sessions for the change to take effect. Red Hat Enterprise Linux 10 Affected freerdp Red Hat Enterprise Linux 6 Out of support scope freerdp Red Hat Enterprise Linux 7 Out of support scope freerdp Red Hat Enterprise Linux 8 Affected freerdp Red Hat Enterprise Linux 9 Affected freerdp https://www.cve.org/CVERecord?id=CVE-2026-68580 https://nvd.nist.gov/vuln/detail/CVE-2026-68580 https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x https://www.vulncheck.com/advisories/freerdp-before-integer-overflow-via-audio-input-channel