CVE-2026-91955 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in multifragment update capability calculations, terminating the server process.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in FreeRDP versions prior to 3.31.0 represents a critical input validation failure within the Remote Desktop Protocol (RDP) implementation during the Gateway Connection Coordinator GCC negotiation phase. This flaw stems from an insufficient check of client-supplied parameters, specifically the DesktopWidth and DesktopHeight values transmitted by the connecting entity. In standard RDP operations, these dimensions define the resolution of the remote desktop session being established. However, in this specific context, the server application fails to enforce reasonable bounds or validate that these integers are non-zero and within expected limits before proceeding with subsequent memory allocation and calculation routines. This lack of sanitization allows a malicious actor to inject crafted RDP packets containing zero values for width or height, or excessively large dimensions that exceed typical display resolutions or internal buffer capacities.
The technical exploitation mechanism relies on the server's attempt to process these invalid parameters during multifragment update capability calculations. When the DesktopWidth and DesktopHeight are set to zero, subsequent arithmetic operations involving division by these dimensions result in a division-by-zero error. Alternatively, oversized values can trigger assertion failures within the internal logic that manages memory layout for screen updates. These errors cause an immediate termination of the server process rather than handling the exception gracefully or returning an appropriate error code to the client. This behavior classifies the vulnerability as a denial-of-service condition, where the availability of the RDP service is compromised through remote exploitation without requiring authentication in many default configurations.
From a security taxonomy perspective, this flaw aligns with CWE-369, which describes divide-by-zero errors resulting from insufficient validation of input values before arithmetic operations. Furthermore, it relates to CWE-20, Improper Input Validation, as the application accepts data that does not meet expected constraints for type and range. In terms of attack vectors, this vulnerability is associated with MITRE ATT&CK technique T1499, Endpoint Denial of Service, specifically under sub-techniques involving resource exhaustion or service disruption through protocol abuse. The ability to crash a remote server process via network packets makes this particularly dangerous in environments where FreeRDP serves as a gateway for multiple concurrent sessions, potentially leading to widespread outages if the vulnerability is exploited repeatedly or by automated scripts targeting public-facing RDP endpoints.
The operational impact of this vulnerability extends beyond simple service interruption. In production environments running FreeRDP as part of a larger infrastructure, such as virtual desktop infrastructure (VDI) solutions or remote access gateways, crashing the server process can disrupt active sessions for legitimate users and require manual intervention to restart services. This not only affects productivity but also increases administrative overhead and potential exposure windows if automatic recovery mechanisms are misconfigured. Additionally, while the primary impact is denial of service, unstable memory states following such crashes could theoretically lead to further instability or unexpected behavior in adjacent processes depending on how the operating system handles the abrupt termination.
Mitigation strategies for this vulnerability primarily involve upgrading FreeRDP to version 3.31.0 or later, where the developers have implemented proper validation checks for DesktopWidth and DesktopHeight during GCC negotiation. Administrators should ensure that all instances of FreeRDP are patched promptly to prevent exploitation. In environments where immediate patching is not feasible due to compatibility constraints, network-level controls such as firewalls or intrusion prevention systems can be configured to inspect RDP traffic for anomalous packet structures containing zero-dimension requests or unusually large header values. Rate limiting connections and monitoring server logs for frequent process restarts can also aid in detecting potential exploitation attempts while longer-term remediation plans are executed.