Executive brief
FreeRDP is an open-source remote desktop protocol implementation used in Linux and other systems to provide RDP server functionality. An unauthenticated remote attacker can crash any FreeRDP server by sending specially crafted RDP connection requests with malformed screen dimension values, causing service unavailability and potential operational disruption.
Technical details
FreeRDP's server-side GCC (Generic Conference Control) negotiation phase fails to validate DesktopWidth and DesktopHeight values supplied by the client, storing them directly into server settings (libfreerdp/core/gcc.c:1186-1187). During the subsequent Demand Active PDU generation, the multifragment update capability writer (libfreerdp/core/capabilities.c:2817-2822) performs unchecked arithmetic division on these attacker-controlled dimensions, triggering either division-by-zero (SIGFPE) when dimensions are zero or assertion failures (abort) when dimensions exceed certain thresholds. Attack vector is network-based and requires no authentication when the server uses TLS or standard RDP security without NLA. The vulnerability was introduced in 2014 and persists unchanged through version 3.30.0; it is patched in version 3.31.0.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-09-15: advisory: CVE-2026-91955 published
- 2026-09-01: patched: Fixed in FreeRDP 3.31.0 (GHSA-4464-r7qj-pgrx advisory published)