CVE-2026-111380
Description
A flaw was found in FreeRDP. When handling audio input on Apple platforms, an integer overflow occurs during buffer size calculations. A malicious Remote Desktop Protocol (RDP) server can exploit this by sending a specially crafted packet during session setup, causing an undersized memory allocation. This flaw can lead to a heap-based buffer overflow, potentially allowing the server to execute arbitrary code or trigger a denial of service on the client system.
Statement
This flaw is rated Important because a malicious RDP server can trigger an integer overflow in FreeRDP Apple audio-input (audin) backends, leading to a heap out-of-bounds write after the user connects (UI:R), with high confidentiality, integrity, and availability impact. This flaw does not affect Red Hat products.
Mitigation
Red Hat freerdp packages are not affected because they do not include the Apple audin backends.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.8 | N/A | 8.8 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | Required | N/A | Required |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
Client must connect to a malicious RDP server (UI:R). Integer overflow in Apple audin backends enables heap OOB write with C:H/I:H/A:H. Red Hat packages do not ship Apple backends; score reflects upstream/client impact.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
