AIKIDO-2026-811370
FreeRDP.FreeRDP is vulnerable to Integer Overflow or Wraparound
75
High Risk
This Affects:
FreeRDP.FreeRDPTL;DR
The audio input redirection channel stores the server-supplied FramesPerPacket value from MSG_SNDIN_OPEN without any bounds check across the ALSA, sndio, WinMM and OpenSL ES backends. That value feeds allocation-size expressions evaluated in 32-bit arithmetic, so a large value wraps to a tiny allocation while the capture APIs still read the original large frame count. On the ALSA backend this produces a heap-based buffer overflow, and the other backends fail or capture into undersized buffers. The fix validates FramesPerPacket and widens the size arithmetic to 64-bit.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you use the audio input (microphone) redirection channel and connect to an untrusted or compromised RDP server.
Background info
FreeRDP.FreeRDP is vulnerable to Integer Overflow or Wraparound in versions 2.0.0 - 3.28.0.
How to fix this
Upgrade the FreeRDP.FreeRDP library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant