Vulnerability · Published Aug 2, 2026 · Assigned by VulnCheck
CVE-2026-68580FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel
High 7.5
In plain English
A high-severity heap buffer overflow in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends that fail to validate the FramesPerPacket parameter from RDP servers. Attackers can supply a malicious FramesPerPacket value causing allocation size wraparound, resulting in heap-based buffer overflow on ALSA or denial of service on all platforms.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | freerdp | 2:3.10.3-12.el10_2.8 | ALSA-2026:54486 |
| AlmaLinux:8 | freerdp | 2:2.11.7-11.el8_10 | ALSA-2026:54485 |
| AlmaLinux:9 | freerdp | 2:2.11.7-7.el9_8.5 | ALSA-2026:54487 |
| AlmaLinux:10 | freerdp-devel | 2:3.10.3-12.el10_2.8 | ALSA-2026:54486 |
| AlmaLinux:8 | freerdp-devel | 2:2.11.7-11.el8_10 | ALSA-2026:54485 |
| AlmaLinux:9 | freerdp-devel | 2:2.11.7-7.el9_8.5 | ALSA-2026:54487 |
| AlmaLinux:10 | freerdp-libs | 2:3.10.3-12.el10_2.8 | ALSA-2026:54486 |
| AlmaLinux:8 | freerdp-libs | 2:2.11.7-11.el8_10 | ALSA-2026:54485 |
| AlmaLinux:9 | freerdp-libs | 2:2.11.7-7.el9_8.5 | ALSA-2026:54487 |
| AlmaLinux:10 | freerdp-server | 2:3.10.3-12.el10_2.8 | ALSA-2026:54486 |
| AlmaLinux:10 | libwinpr | 2:3.10.3-12.el10_2.8 | ALSA-2026:54486 |
| AlmaLinux:8 | libwinpr | 2:2.11.7-11.el8_10 | ALSA-2026:54485 |
| AlmaLinux:9 | libwinpr | 2:2.11.7-7.el9_8.5 | ALSA-2026:54487 |
| AlmaLinux:10 | libwinpr-devel | 2:3.10.3-12.el10_2.8 | ALSA-2026:54486 |
| AlmaLinux:8 | libwinpr-devel | 2:2.11.7-11.el8_10 | ALSA-2026:54485 |
| AlmaLinux:9 | libwinpr-devel | 2:2.11.7-7.el9_8.5 | ALSA-2026:54487 |
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-68580 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-68580 |
| Debian:14 | freerdp3 | 3.29.0+dfsg-1 | DEBIAN-CVE-2026-68580 |
| Rocky Linux:10 | freerdp | 2:3.10.3-12.el10_2.8 | RLSA-2026:54486 |
| Rocky Linux:8 | freerdp | 2:2.11.7-11.el8_10 | RLSA-2026:54485 |
| Rocky Linux:9 | freerdp | 2:2.11.7-7.el9_8.5 | RLSA-2026:54487 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-68580 |
| Ubuntu:24.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-68580 |
| Ubuntu:26.04:LTS | freerdp3 | 3.30.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-68580 |
Affected products (as reported)
Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- GitHub Security Advisory (GHSA-69xf-pqrw-596x) vendor-advisory
- VulnCheck Advisory: FreeRDP before 3.29.0 Integer Overflow via Audio Input Channel third-party-advisory