CVE-2026-91945 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP versions before 3.31.0 contain an out-of-bounds read vulnerability in smartcard response decoders that fail to validate ATR length fields against fixed inline arrays. Authenticated RDP clients can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap objects, causing process termination.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in FreeRDP versions prior to 3.31.0 represents a critical memory safety flaw located within the smartcard response decoding subsystem. This issue specifically affects how the application processes Automatic Terminal Request ATR length fields contained within PAKID_CORE_DEVICE_IOCOMPLETION responses sent by authenticated Remote Desktop Protocol clients. The core technical deficiency lies in the absence of rigorous boundary validation when these length values are utilized to index into fixed-size inline arrays on either the stack or heap memory segments. In a properly secured implementation, any external input determining array access size must be strictly compared against the maximum allowable bounds defined by the target data structure. However, in this specific code path, the application accepts the ATR length field from the remote client without verifying that it does not exceed the allocated capacity of the destination buffer or stack variable. This lack of validation allows an attacker to craft a maliciously sized response packet where the declared length is significantly larger than what the local memory structures can accommodate.
When such an oversized value is processed, the application proceeds to read data from memory locations that lie beyond the intended boundaries of the allocated object. This constitutes an out-of-bounds read vulnerability, which falls under the Common Weakness Enumeration category CWE-125: Out-of-bounds Read. The operational consequence of this flaw is immediate and severe for the service handling the connection. Because the read operation accesses invalid memory addresses, it triggers a segmentation fault or similar access violation within the operating system's memory management unit. This results in the abrupt termination of the FreeRDP process. While the primary impact observed is denial of service through application crash rather than arbitrary code execution, the instability introduced can disrupt remote desktop sessions and potentially cause cascading failures if the affected component is part of a larger server infrastructure that relies on continuous availability. The requirement for authentication means that an unauthenticated attacker cannot exploit this directly, but any user with valid credentials to connect via RDP possesses the necessary access vector to trigger this condition remotely over the network.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1499: Endpoint Denial of Service, as it enables an authenticated actor to disrupt service availability by causing process crashes. The exploitation mechanism relies on manipulating protocol-specific fields that are typically trusted or assumed to be safe within the application logic. To mitigate this risk, organizations running FreeRDP must immediately upgrade to version 3.31.0 or later, where developers have implemented proper bounds checking for ATR length validation before array access occurs. Until an update is applied, administrators should consider restricting RDP access to only trusted and verified users through network segmentation or strict firewall rules to limit the attack surface. Additionally, deploying intrusion detection systems that monitor for anomalous packet sizes in smartcard-related traffic may provide early warning of exploitation attempts, although definitive prevention requires patching the underlying software defect.