CVE-2026-91950 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in FreeRDP versions prior to 3.31.0 represents a critical security flaw within the Remote Desktop Protocol (RDP) device redirection subsystem, specifically located in the rdpdr_dump_packet function. This issue stems from an improper handling of integer values during buffer bounds validation, which allows for an out-of-bounds read condition that can be exploited by remote attackers. The core technical mechanism involves a 32-bit unsigned integer wraparound vulnerability within the logic responsible for validating packet lengths and offsets. When processing incoming RDPDR packets, the software fails to correctly account for arithmetic overflow scenarios where large values interact with smaller buffer sizes or offset calculations. This mathematical error results in the validation checks passing when they should fail, effectively bypassing the protective boundaries designed to keep memory access within allocated limits.
A malicious actor operating a rogue or compromised RDP server can exploit this flaw by crafting specific network packets that contain manipulated header fields. By setting the computerNameLen field to a value such as 0xFFFFFFF0, an attacker triggers the integer wraparound behavior during subsequent calculations involving buffer size and current read position. Because the validation logic interprets these wrapped values incorrectly, it permits the application to proceed with reading data from memory locations that lie beyond the end of the allocated packet buffer. This constitutes a classic out-of-bounds read vulnerability where the program accesses sensitive areas of heap or stack memory without authorization. The attack vector is remote and requires only network connectivity to the vulnerable FreeRDP client, making it particularly dangerous in environments where users connect to untrusted or public RDP servers.
The operational impact of this vulnerability is significant, primarily manifesting as denial-of-service conditions through application crashes. When the out-of-bounds read occurs, it often leads to segmentation faults or access violations that terminate the FreeRDP client process abruptly. However, beyond simple stability issues, the flaw poses a severe risk of information disclosure. The memory regions accessed during this erroneous operation may contain sensitive data such as private keys, session tokens, passwords, or other confidential user information stored in adjacent heap allocations. If these leaked bytes are subsequently written to log files or diagnostic outputs, they can be exfiltrated by the attacker who controls the malicious RDP server. This transforms a stability bug into a potent vector for stealing credentials and compromising long-term security posture through credential harvesting via memory disclosure.
From a classification perspective, this vulnerability aligns with CWE-190 Integer Overflow or Wraparound as the root cause, which directly leads to CWE-125 Out-of-bounds Read in terms of the resulting exploitation technique. In the context of offensive cyber operations and defensive mapping, this behavior corresponds to ATT&CK techniques related to Collection via Input Capture and potentially Data from Local System Memory Dumping if the leaked data is substantial enough for analysis. The vulnerability highlights the critical importance of rigorous input validation and safe arithmetic practices in network protocol parsers, particularly when dealing with untrusted external inputs that dictate memory layout operations.
Mitigation strategies must prioritize immediate software updates to version 3.31.0 or later where this integer wraparound logic has been corrected by implementing proper saturation checks or using wider integer types for intermediate calculations. For organizations unable to patch immediately due to dependency constraints, network-level controls such as firewalls and intrusion detection systems should be configured to inspect RDP traffic for anomalous packet structures indicative of this exploit attempt. Additionally, deploying application whitelisting can prevent the execution of unpatched FreeRDP binaries in high-risk environments. Security teams should also monitor logs for unusual crashes or memory access violations associated with RDP sessions and consider restricting connections from unknown or external RDP servers until all client endpoints are verified as patched. Regular vulnerability scanning focused on protocol implementation flaws is essential to detect such misconfigurations before they can be leveraged in targeted attacks against corporate infrastructure.