Executive brief
FreeRDP is an open-source Remote Desktop Protocol client used to connect to Windows and other systems. Versions before 3.31.0 contain a flaw where maliciously crafted RDP connection files can trigger out-of-bounds memory reads and writes when opened, potentially causing the client to crash or allowing attackers to read or modify sensitive memory on the user's system.
Technical details
The vulnerability is a classic out-of-bounds array access (CWE-125) in the X11-specific monitor detection code. When parsing RDP connection files, the selectedmonitors field is parsed into a MonitorIds array with no validation that the values correspond to actual attached monitors. The xf_detect_monitors() function later uses MonitorIds[0] directly as an index into a heap-allocated rdpmonitors array sized to the number of physically connected monitors. An attacker can craft an RDP file with a large selectedmonitors value (e.g., 999) that does not match any real monitor, causing the fallback logic to run and the code to access rdpmonitors[999] on a typical 2-monitor system, reading or writing approximately 44 KB past the allocated buffer. The attack requires only that a user open a malicious .rdp file with xfreerdp; no network connection or authentication is necessary. Patches are available in version 3.31.0.
Affected products
- FreeRDP Project FreeRDP 3.11.0 through 3.30.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory published
- 2026-09-15: advisory: NVD entry and CVE-2026-91958 published
- 2026-09-15: patched: FreeRDP 3.31.0 released with fix