CVE-2026-91959 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Attackers can send a malicious BIND_ACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/15/2026
The FreeRDP project, a widely used open-source implementation of Microsoft Remote Desktop Protocol (RDP), contains a critical memory safety vulnerability in versions prior to 3.31.0 that affects the reliability and availability of remote desktop sessions. This flaw is located within the RPC gateway transport parser, specifically inside the rts_read_result function which handles the parsing of Result entries during the initialization phase of an RDP connection via the Remote Desktop Gateway service. The vulnerability arises from insufficient validation of input data length relative to the allocated buffer boundaries when processing a maliciously crafted BIND_ACK Protocol Data Unit (PDU). An attacker can exploit this by sending a specially constructed BIND_ACK message that contains a truncated result entry, causing the parser to attempt reading memory beyond the valid bounds of the associated buffer.
From a technical perspective, this issue is classified as an out-of-bounds read vulnerability, which aligns with Common Weakness Enumeration identifier CWE-125: Out-of-bounds Read. The root cause lies in the lack of rigorous boundary checks before accessing array elements or memory regions derived from network input. When the rts_read_result function processes a BIND_ACK PDU with an unexpectedly short result entry, it fails to verify that the requested data length does not exceed the available buffer size. Consequently, the application attempts to read from invalid memory locations, which typically results in immediate process termination due to segmentation faults or similar operating system-level protections against illegal memory access. While this specific manifestation primarily leads to a denial of service through process abort rather than arbitrary code execution, it represents a significant stability risk for servers handling untrusted RDP connections.
The operational impact of this vulnerability is predominantly focused on availability and service continuity. Since the exploit triggers an immediate crash or abort of the FreeRDP client or server component depending on which side processes the malformed packet, attackers can disrupt ongoing remote desktop sessions without requiring authentication in some configurations. This denial-of-service capability allows malicious actors to exhaust system resources by repeatedly crashing the RDP gateway process, thereby preventing legitimate users from accessing critical infrastructure managed through Remote Desktop services. In environments where FreeRDP is deployed as a client connecting to external gateways or when used within headless server applications that rely on stable RDP sessions for automation and management tasks, such crashes can lead to significant operational downtime and potential data loss if unsaved work is involved in the affected session.
Mitigation strategies primarily involve upgrading to FreeRDP version 3.31.0 or later, where this boundary check has been corrected to ensure that all read operations remain within valid memory limits regardless of input truncation. For organizations unable to immediately patch their systems, network-level filtering can provide temporary relief by restricting inbound RDP traffic (typically on TCP port 3389 for direct connections and ports associated with the Remote Desktop Gateway service) to trusted IP ranges only. Additionally, deploying intrusion detection or prevention systems that inspect RPC gateway payloads for malformed PDUs during the handshake phase may help block exploit attempts before they reach the vulnerable parser logic. It is also advisable to review ATT&CK technique T1496: Resource Hijacking if monitoring for signs of denial-of-service activity targeting RDP services, as repeated crashes can be indicative of such abuse patterns in enterprise environments.