Vulnerability Details CVE-2026-91962
FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN messages. Attackers can supply crafted FramesPerPacket values that cause AudioQueueAllocateBuffer size computation to wrap, resulting in undersized buffer allocation and potential out-of-bounds access.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 15.9%
CVSS Severity
CVSS v3 Score 6.3