FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
CVSS Details
- CVSS 4.0 Base Score: 7.7 (HIGH)
- CVSS 4.0 Vector: (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X)
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade libwinpr-develUpgrade freerdpUpgrade libwinprUpgrade libwinpr-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-debugsourceUpgrade freerdp-debuginfoUpgrade freerdp-develUpgrade freerdp-serverUpgrade freerdp-libs-debuginfoUpgrade freerdp-libs | Sep 1, 2026 | Aug 2, 2026 |
| Redhat_linux | — | Upgrade freerdp-libsUpgrade libwinpr-debuginfoUpgrade freerdp-develUpgrade freerdp-debuginfoNo solution existsUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade freerdp-server-debuginfoUpgrade freerdp-serverUpgrade freerdpUpgrade libwinpr-develUpgrade freerdp-debugsource | Aug 4, 2026 | Aug 2, 2026 |
| Rocky_linux | — | Upgrade freerdp-libsUpgrade libwinprUpgrade freerdp-libs-debuginfoUpgrade libwinpr-debuginfoUpgrade libwinpr-develUpgrade freerdp-develUpgrade freerdp-debugsourceUpgrade freerdpUpgrade freerdp-debuginfo | Aug 17, 2026 | Aug 14, 2026 |
| Ubuntu | — | Upgrade freerdp3 | Aug 17, 2026 | Aug 2, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub