FreeRDP before 3.29.0 contains integer overflow vulnerabilities in the audio input redirection channel (audin) across ALSA, sndio, WinMM, and OpenSL ES backends…

FreeRDP versions before 3.29.0 are affected by integer overflow vulnerabilities in the audio input redirection channel (audin). The issue spans multiple backends including ALSA, sndio, WinMM, and OpenSL ES, all of which fail to properly validate the FramesPerPacket parameter received from RDP servers. An attacker controlling a malicious RDP server can supply a crafted FramesPerPacket value that causes allocation size wraparound. On ALSA, this results in a heap-based buffer overflow, which could potentially lead to arbitrary code execution. On all affected platforms, the vulnerability can cause denial of service. The fix is available in FreeRDP 3.29.0. Users are advised to upgrade immediately to mitigate the risk of exploitation in remote desktop scenarios.