Executive brief
FreeRDP is a popular open-source Remote Desktop Protocol client used to connect to Windows servers and systems. A malicious RDP server or network attacker can exploit a buffer overflow in the connection negotiation phase to corrupt the client's memory or crash it, even before the user is authenticated. This occurs before any encryption or security protocols are active, making it reachable with default client settings.
Technical details
The vulnerability is a heap buffer overflow in the nego_send_negotiation_request() function in libfreerdp/core/nego.c. The function allocates a fixed 512-byte stream to hold a routing token from the LB_LOAD_BALANCE_INFO field of an RDP Server Redirection PDU, but fails to validate the token length before writing it via Stream_Write(). A malicious RDP server or man-in-the-middle attacker can craft a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value (≥492 bytes) to trigger the overflow. The PDU is not cryptographically signed and is accepted before authentication completes. In release builds with assertions disabled (common in Linux distributions), this results in heap memory corruption with attacker-controlled content; in debug builds, an assertion abort causes denial of service. The vulnerability is fixed in FreeRDP 3.31.0 by validating the token length before the write operation.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-09-01: disclosed: GitHub Security Advisory GHSA-r9pv-ffph-6gg6 published
- 2026-09-15: advisory: CVE-2026-91953 published on NVD
- 2026-09-15: patched: Fixed in FreeRDP 3.31.0