CVE-2026-91962: Freerdp

Medium severity, CVSS 6.3. EPSS: 0.3% chance of exploitation in the next 30 days.

FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer allocation and potential out-of-bounds access.

Affected products

• Freerdp Freerdp: before 3.31.0 (fixed in 3.31.0)

Published 2026-09-15. Last modified 2026-09-23.