Executive brief
FreeRDP is an open-source Remote Desktop Protocol client used to connect to Windows servers and remote desktops. A malicious RD Gateway server can send a specially crafted network packet that causes the FreeRDP client to crash before any session is established, resulting in a denial of service. An attacker would need to trick a user into connecting through a gateway under their control.
Technical details
The vulnerability is an out-of-bounds read (CWE-125) in the rts_read_result() function within the RPC gateway transport parser (libfreerdp/core/gateway/rts.c). The function checks for 2 bytes of available data but then reads 4 bytes (the "reason" field), creating a gap in validation. A malicious BIND_ACK PDU with a truncated result entry exploits this mismatch. The attack requires the victim to connect through a gateway controlled by the attacker (e.g., via a malicious .rdp file), making it network-adjacent rather than purely remote. On default Release builds with assertions enabled, this triggers a process abort via WINPR_ASSERT; with assertions disabled, it results in a 2-byte over-read. Patched in version 3.31.0.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-09-01: disclosed: GitHub security advisory published
- 2026-09-15: advisory: CVE-2026-91959 published
- 2026-09-01: patched: Fix available in version 3.31.0