CVE-2026-91964 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
FreeRDP versions prior to release 3.31.0 are susceptible to a critical heap-based buffer overflow vulnerability located within the nego_send_negotiation_request function. This flaw specifically manifests during the processing of Server Redirection Protocol Data Units, which are used in Remote Desktop Protocol sessions to redirect clients to alternate servers for load balancing or failover purposes. The root cause lies in the inadequate validation of the LoadBalanceInfo field contained within these redirection messages. When a malicious RDP server initiates a connection and sends a Server Redirection PDU with an attacker-controlled LoadBalanceInfo payload, the application fails to verify that the length of this information does not exceed the allocated buffer size before attempting to copy it into memory.
The technical mechanism of the exploit involves writing data from the arbitrary-length field directly into a fixed 512-byte heap-allocated buffer without performing necessary bounds checking. Because the input is derived from an external network source and its length is determined by the attacker, they can craft a payload significantly larger than five hundred twelve bytes. When this oversized payload is processed, it overflows the boundaries of the designated memory region, corrupting adjacent heap metadata or data structures. This type of vulnerability is classically categorized under CWE-120 Buffer Copy without Checking Size of Input and represents a severe integrity violation within the application's memory management subsystem.
The operational impact of this vulnerability extends beyond simple service disruption. While an immediate consequence is often a client crash resulting in denial of service, the true severity arises when this heap overflow is chained with other vulnerabilities such as out-of-bounds reads or information disclosure primitives. By carefully crafting the overflow payload and leveraging memory corruption techniques, an attacker can potentially achieve arbitrary code execution on the vulnerable FreeRDP client system. This transforms a simple connectivity issue into a critical remote code execution risk, allowing for full compromise of the user's workstation if they connect to a rogue RDP server designed to exploit this flaw.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK techniques related to initial access and privilege escalation via exploited client-side software. Attackers can deploy malicious RDP servers as part of phishing campaigns or man-in-the-middle attacks within untrusted networks to trigger the overflow during legitimate-looking connection attempts. The exploitation does not require user interaction beyond initiating a session, making it particularly dangerous in environments where users frequently connect to various remote desktop endpoints without verifying server authenticity through certificate pinning or other strict validation methods.
Mitigation strategies must prioritize immediate patching of all FreeRDP installations to version 3.31.0 or later, which includes the necessary input validation fixes for the LoadBalanceInfo field. In environments where upgrading is not immediately feasible, network-level controls should be implemented to restrict RDP connections only to trusted and verified servers. Additionally, deploying intrusion detection systems capable of identifying anomalous packet sizes in RDP traffic can provide a layer of defense against exploitation attempts. Security teams should also enforce strict certificate validation policies to prevent clients from accepting redirection requests from untrusted or self-signed sources, thereby reducing the attack surface available for this specific vector.