Executive brief
FreeRDP is an open-source Remote Desktop Protocol client that allows users to connect to Windows-based remote systems. A malicious RDP server can send specially crafted graphics updates that cause the FreeRDP client to enter an infinite loop, consuming CPU resources and making the application unresponsive. An attacker would need to trick a user into connecting to a compromised or malicious RDP server to exploit this vulnerability.
Technical details
The vulnerability is an infinite loop (CWE-835) in the pool_decode_rect function within libfreerdp/codec/yuv.c. The bug occurs when decoding AVC444 graphics metablocks where the numRegionRects field exceeds the preallocated work_object_count. The vulnerable code reuses the loop variable waitCount as both an iteration counter and array index; when the array boundary is reached, waitCount is reset to 0 within the loop, preventing the loop from ever terminating. This affects only the threaded decode path when useThreads is TRUE and EXTGPU fast-path is not active. Exploitation requires a victim to connect to an attacker-controlled RDP server and process the malicious graphics update; no prior authentication or code execution is achieved, only client-side CPU denial of service.
Affected products
- FreeRDP Project FreeRDP 3.11.0 to before 3.31.0
Timeline
- 2026-09-01: disclosed: GitHub Security Advisory GHSA-m85m-3qxv-63h5 published
- 2026-09-15: advisory: CVE-2026-91952 published in NVD