CVE-2026-91962

A flaw was found in FreeRDP. An integer overflow in the audin Apple backends, specifically when processing FramesPerPacket values from MSG_SNDIN_OPEN messages, allows a malicious RDP (Remote Desktop Protocol) server to supply crafted values. This can cause the AudioQueueAllocateBuffer size computation to wrap, leading to an undersized buffer allocation and potential out-of-bounds access. This memory safety issue could result in information disclosure, denial of service, or potentially arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure that FreeRDP is not configured to use the audin Apple backends. This specific functionality is not typically enabled by default in Red Hat Enterprise Linux environments. If FreeRDP is used to connect to macOS systems and audio input redirection is enabled, consider disabling this feature or restricting connections to trusted remote desktop servers.