FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debugsourceUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-server-debuginfoUpgrade freerdp-debuginfoUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-develUpgrade freerdp-libs | Sep 1, 2026 | Aug 2, 2026 |
| Redhat_linux | — | Upgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdp-develUpgrade freerdp-debuginfoUpgrade libwinprNo solution existsUpgrade freerdp-libs-debuginfoUpgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-debugsource | Aug 4, 2026 | Aug 2, 2026 |
| Rocky_linux | — | Upgrade freerdp-debugsourceUpgrade freerdp-develUpgrade libwinpr-develUpgrade freerdpUpgrade freerdp-debuginfoUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinprUpgrade freerdp-libs | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub