CVE-2026-91953 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in FreeRDP versions prior to 3.31.0 represents a critical memory safety failure within the Remote Desktop Protocol negotiation phase. Specifically, the flaw resides in the nego_send_negotiation_request function, which is responsible for handling server redirection information during the initial connection establishment process. The core technical deficiency lies in the absence of rigorous length validation for the LB_LOAD_BALANCE_INFO field extracted from incoming Server Redirection PDUs. When a client processes this data, it attempts to write the contents directly into a fixed-size buffer allocated with 512 bytes on the heap. Because the implementation does not verify that the size of the LB_LOAD_BALANCE_INFO payload fits within these bounds, an oversized value results in a classic heap buffer overflow condition where writes extend beyond the allocated memory region.
This architectural oversight allows for significant operational impact depending on the execution context and attacker capabilities. A malicious RDP server or a man-in-the-middle actor positioned between the client and the legitimate server can craft a specially constructed Server Redirection PDU containing an excessively long LB_LOAD_BALANCE_INFO field. Upon receipt, this malformed data triggers the buffer overflow before any user authentication takes place, meaning no credentials are required to exploit the flaw. The immediate consequence is typically a denial of service caused by application crash due to memory corruption. However, in more sophisticated scenarios involving heap layout manipulation and specific allocator behaviors, this vulnerability could potentially be leveraged for arbitrary code execution or privilege escalation, although such exploitation would require precise control over adjacent heap metadata and allocation patterns.
From a classification perspective, this issue aligns with CWE-120, which denotes Buffer Copy without Checking Size of Input, as the root cause is the failure to validate input length against buffer capacity. It also maps to ATT&CK technique T1563, specifically Remote Service Session Hijacking or initial access vectors involving protocol exploitation, although in this pre-authentication context it serves primarily as an entry point for denial-of-service attacks rather than session hijacking per se. The vulnerability highlights the risks associated with trusting network-provided metadata without strict boundary checks during early-stage protocol negotiations where security controls are not yet fully active.
Mitigation strategies must prioritize immediate patching to version 3.31.0 or later, which includes the necessary bounds checking logic within the negotiation handler. For environments where upgrading is not immediately feasible, deploying network-level intrusion detection systems capable of inspecting RDP traffic for anomalously large LB_LOAD_BALANCE_INFO fields can provide a layer of defense in depth. Additionally, restricting access to FreeRDP clients through firewalls and ensuring that only trusted servers are contacted reduces the attack surface by limiting exposure to untrusted or potentially malicious endpoints. Regular security audits focusing on memory safety practices in C-based protocol implementations are recommended to prevent similar buffer overflow vulnerabilities in future development cycles.