CVE-2026-91962

Executive Summary

CVE-2026-91962 is an integer overflow vulnerability in the FreeRDP "audin" (audio input) Apple backends. A malicious or compromised RDP server can send a crafted MSG_SNDIN_OPEN message containing a malicious FramesPerPacket value that causes the size computation for AudioQueueAllocateBuffer to wrap around, resulting in an undersized buffer allocation and potential out-of-bounds memory access. FreeRDP clients running before version 3.31.0 on Apple platforms (macOS/iOS) are affected. With a CVSS base score of 6.3, the flaw requires user interaction (connecting to a hostile RDP server) but can compromise confidentiality, integrity, and availability at a low level.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP). The audin subsystem handles audio input redirection — the mechanism by which audio captured on the client (e.g., a microphone) is streamed back to the RDP server. The Apple backend specifically implements this using Apple's AudioQueue APIs.

The vulnerability resides in the processing of the MSG_SNDIN_OPEN message, which is sent by the server to negotiate audio input parameters. Among the fields in this message is FramesPerPacket, a value that describes how many audio frames are contained in each audio packet. This value is server-controlled and is not sufficiently validated before being used in a size calculation.

According to the NVD description, when a crafted FramesPerPacket value is supplied, the computation passed to AudioQueueAllocateBuffer overflows. Integer overflow (CWE-131, "Incorrect Calculation of Buffer Size") causes the computed allocation size to wrap to a small value. The resulting buffer is therefore undersized relative to what the subsequent audio processing logic expects. When data is later written into or read from this buffer based on the (large, unwrapped) logical size, an out-of-bounds memory access occurs.

Key technical points:

• Attack vector: Network (AV:N) — the malicious input originates from the RDP server.
• Attack complexity: Low (AC:L) — no special conditions beyond sending a crafted message.
• Privileges required: None (PR:N) — the attacker does not need authenticated access to the client; they control the server side.
• User interaction: Required (UI:R) — the victim must initiate an RDP session to a malicious server.
• Scope: Unchanged (S:U) — the impact remains within the FreeRDP client process.
• Impact: Low confidentiality, integrity, and availability (C:L/I:L/A:L) — consistent with an out-of-bounds access that may leak memory, corrupt adjacent data, or crash the client.

The vulnerable code path is specific to the Apple/native audio backend of FreeRDP's audin module. Other platform backends may not share the exact AudioQueueAllocateBuffer call, but the underlying insufficient validation of FramesPerPacket may be present in shared parsing logic.

No public proof-of-concept, exploit code, or Nuclei template is available at the time of writing. The EPSS score is 0.00244 (15.7th percentile), indicating a low predicted likelihood of exploitation in the near term. The CVE is not listed in CISA KEV.

Exploitation Scenarios

The attack chain is inferred from the vulnerability class (integer overflow in buffer size calculation) and the information in the NVD description. No public PoC exists.

1. Reconnaissance / Target Identification

An attacker sets up a rogue or compromised RDP server (or takes over an existing one) that will be connected to by a victim using a vulnerable FreeRDP client on an Apple platform. The attacker identifies that the victim uses an affected FreeRDP client on macOS or iOS, and that audio input redirection is enabled (or can be negotiated). No scanning of the victim is strictly required; the attacker simply needs the victim to connect to the attacker-controlled server. Alternatively, a man-in-the-middle position could be used to inject the crafted message into an existing RDP session.

2. Triggering the Flaw

When the victim connects to the malicious RDP server, the server sends a MSG_SNDIN_OPEN message as part of the audio input channel negotiation. The server includes a specially crafted FramesPerPacket value chosen so that the multiplication/addition used to compute the AudioQueueAllocateBuffer size wraps around a fixed-width integer. For example, a very large FramesPerPacket could cause the product with the per-frame size to exceed the maximum representable value for the integer type used, resulting in a small wrapped size.

3. Payload / Execution Method

The vulnerability-class payload is the crafted FramesPerPacket field itself. No additional code execution payload is required at this stage; the malformed value is the trigger. The undersized buffer is then used by the audio backend. If the server subsequently sends audio data sized according to the (large) logical expectation, the client writes beyond the allocated buffer, causing an out-of-bounds access. An attacker could attempt to shape the overflow to corrupt adjacent heap memory, potentially influencing control flow or data structures — though no public exploit demonstrates this.

4. Post-Exploitation Impact

Successful exploitation could lead to:

• Memory disclosure: Out-of-bounds read may leak sensitive memory contents from the client process.
• Memory corruption: Out-of-bounds write may corrupt adjacent data, potentially leading to crash (denial of service) or, in a more sophisticated scenario, arbitrary code execution within the context of the FreeRDP client.
• Availability impact: A crash of the RDP client disrupts the user's session.

The CVSS impact subscore (C:L/I:L/A:L) suggests the realistic impact is limited — likely memory corruption leading to crash or partial information disclosure — rather than guaranteed remote code execution. The requirement for user interaction (connecting to a malicious server) limits the severity. However, an attacker who can position themselves as a man-in-the-middle on an RDP connection, or who can compromise a legitimate RDP server, could target many users.

Impact Assessment

Affected systems: FreeRDP clients on Apple platforms (macOS, iOS) running versions before 3.31.0, specifically when the audin Apple backend is enabled and used. Organizations using FreeRDP for remote desktop access on Apple devices are at risk.

CVSS subscores:

• AV:N — The attack is launched over the network via RDP messages.
• AC:L — No special conditions beyond sending a crafted message.
• PR:N — The attacker does not need credentials on the client; they act as the server.
• UI:R — The victim must connect to the malicious server.
• S:U — Impact is confined to the FreeRDP client process.
• C:L/I:L/A:L — Low confidentiality, integrity, and availability impact.

Business impact: If exploited, the vulnerability could allow an attacker to crash the RDP client (availability), potentially exfiltrate small amounts of memory (confidentiality), or corrupt client memory (integrity). In a targeted attack, a sophisticated adversary might chain this with another vulnerability or use the memory corruption to achieve code execution. The blast radius includes any user who connects to an untrusted RDP server using a vulnerable client. The EPSS score (0.00244, 15.7th percentile) and absence from CISA KEV suggest that exploitation is not currently widespread.

Detection Guidance

Detection for this vulnerability is challenging because the malicious input is an RDP protocol message (MSG_SNDIN_OPEN) that may not be easily inspected by network sensors if the RDP session is encrypted (TLS). Network detection would need to inspect decrypted traffic or rely on endpoint behavioral indicators, such as crashes in the FreeRDP client or anomalous audio subsystem activity.

Sigma Rule

title: Potential FreeRDP Audin Integer Overflow Exploitation Attempt
id: 8f4a2b1c-9d3e-4f5a-6b7c-8d9e0f1a2b3c
status: experimental
description: Detects process crashes or errors in FreeRDP client that may indicate exploitation of CVE-2026-91962 (audin integer overflow)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-91962
author: Valters IT Threat Intelligence
date: 2026/01/15
tags:
    - attack.t1203
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\\xfreerdp.exe'
            - '\\wfreerdp.exe'
        CommandLine|contains:
            - '/sound'
            - '/microphone'
    condition: selection
fields:
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Legitimate use of FreeRDP with audio input enabled
level: low

Note: This Sigma rule is a behavioral heuristic for the client-side process; the actual crash or memory error would be logged by endpoint protection or application error logs, not by process creation alone. A more precise rule would require application-specific crash telemetry.

YARA Rule

rule CVE_2026_91962_FreeRDP_Audin_Overflow
{
    meta:
        description = "Detects FreeRDP binaries potentially vulnerable to CVE-2026-91962 audin integer overflow"
        author = "Valters IT Threat Intelligence"
        date = "2026-01-15"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91962"
        hash = "unknown"
    strings:
        $s1 = "AudioQueueAllocateBuffer" ascii wide
        $s2 = "MSG_SNDIN_OPEN" ascii wide
        $s3 = "FramesPerPacket" ascii wide
        $s4 = "audin" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        (($s1 and $s2) or ($s1 and $s3) or ($s2 and $s4))
}

Note: This YARA rule is a static indicator for identifying FreeRDP binaries that contain the relevant code paths. It does not confirm exploitability. The strings are derived from the NVD description and may appear in legitimate binaries.

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-91962 FreeRDP Audin Integer Overflow Attempt (MSG_SNDIN_OPEN)"; flow:to_client,established; content:"|00 00 00|"; depth:3; content:"|00 00|"; distance:0; within:4; content:"|00 00 00 00|"; distance:0; within:8; classtype:attempted-user; sid:10000001; rev:1; metadata:created_at 2026_01_15, updated_at 2026_01_15, cve CVE-2026-91962;)

Note: Without a public PoC or protocol decoder, crafting a precise Suricata rule for the RDP audio channel is speculative. The above is a placeholder pattern for the RDP MCS/security header followed by a generic payload; it is not reliable and should be tuned with real packet captures. RDP traffic is often encrypted, so this rule applies only to plaintext or decrypted sessions.

Elastic Detection

process where process.name in ("xfreerdp", "wfreerdp", "FreeRDP") and
  (process.args : "*sound*" or process.args : "*microphone*") and
  event.action == "process-crash"

This EQL query looks for crashes of FreeRDP processes that were launched with audio input redirection enabled. It assumes that crash events are ingested into Elastic.

Splunk SPL Query

index=main (sourcetype="WinEventLog:Application" OR sourcetype="syslog")
| search ("FreeRDP" OR "xfreerdp" OR "wfreerdp") ("AudioQueueAllocateBuffer" OR "MSG_SNDIN_OPEN" OR "FramesPerPacket" OR "audin")
| stats count by host, source, Message
| where count > 0

This search looks for application logs containing indicators related to the vulnerable component. It may generate false positives from legitimate FreeRDP logging.

Wazuh OSSEC Rule

<group name="freerdp,">
  <rule id="100100" level="6">
    <decoded_as>json</decoded_as>
    <field name="program">FreeRDP|xfreedp|wfreedp</field>
    <match>AudioQueueAllocateBuffer|MSG_SNDIN_OPEN|FramesPerPacket|audin</match>
    <description>Potential FreeRDP CVE-2026-91962 exploitation attempt detected</description>
    <mitre>
      <id>T1203</id>
    </mitre>
  </rule>
</group>

This Wazuh rule triggers on log entries from FreeRDP processes containing strings associated with the vulnerability. It requires that FreeRDP logs be forwarded to Wazuh and parsed as JSON.

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch (not independently confirmed)). The OSV database indicates that FreeRDP before 3.31.0 is affected and that version 3.31.0 contains a fix. No vendor advisory has been independently verified, and no explicit patch commit or release notes are available in the provided data.

1. Immediate Mitigations

• Disable audio input redirection when connecting to untrusted RDP servers. In FreeRDP, this can be done by omitting the /sound or /microphone flags, or by explicitly disabling audio input in the client configuration.
• Avoid connecting to untrusted or unverified RDP servers using vulnerable FreeRDP clients on Apple platforms.
• Use a VPN or SSH tunnel to ensure RDP traffic is encrypted and terminated at a trusted endpoint, reducing the risk of man-in-the-middle injection of malicious messages.
• Monitor for crashes of FreeRDP clients, which may indicate exploitation attempts.

2. Patch / Upgrade Steps

• Upgrade to FreeRDP 3.31.0 or later. If using a package manager (Homebrew, MacPorts, etc.), update accordingly.
• Verify the patch: After upgrading, confirm the client version is 3.31.0 or higher. Since patch confidence is low, monitor the FreeRDP GitHub repository and official release notes for confirmation of the fix.
• Redeploy: Update any packaged or bundled FreeRDP clients used in your environment.

3. Long-Term Hardening

• Implement application whitelisting to prevent unauthorized RDP clients.
• Use endpoint detection and response (EDR) to monitor for memory corruption indicators in FreeRDP processes.
• Conduct regular vulnerability scanning of client software and prioritize patches for network-facing applications.
• Adopt a least-privilege model for RDP connections; avoid enabling unnecessary features like audio input when not required.
• Monitor FreeRDP security advisories and subscribe to vendor notifications.

References

1. NVD — CVE-2026-91962: https://nvd.nist.gov/vuln/detail/CVE-2026-91962
2. OSV — FreeRDP advisory (claimed patch source): https://osv.dev/vulnerability/CVE-2026-91962 (verify exact OSV ID)
3. FreeRDP GitHub Repository — Releases: https://github.com/FreeRDP/FreeRDP/releases
4. FreeRDP Security Advisories: https://github.com/FreeRDP/FreeRDP/security/advisories
5. CWE-131 — Incorrect Calculation of Buffer Size: https://cwe.mitre.org/data/definitions/131.html

Threat actor campaigns / exploit-in-the-wild: No public exploit code, PoC, or evidence of active exploitation is available. CVE not in CISA KEV. EPSS 0.00244 (15.7th percentile) indicates low likelihood of exploitation at this time.