Vulnerability details

CVE-2026-68580

FreeRDP FreeRDP

FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel

CVSS 4.0

7.7High

Official description

FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.

CVSS scores

Score	Version	Source	Vector
7.7High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
7.5High	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
FreeRDP	FreeRDP	v < 3.29.0	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-69xf-pqrw-596x vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-integer-overflow-via-audio-input-channel third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-08-02
Last updated: 2026-08-05
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.29%

Probability of exploitation in 30 days

22.6%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-122
Heap-based Buffer Overflow