Executive brief
FreeRDP is a remote desktop protocol client used to connect to Windows systems. A malicious RD Gateway server can crash the FreeRDP client before authentication completes by sending a specially crafted WebSocket frame, causing a denial of service. This requires the user to connect through a compromised or attacker-controlled gateway.
Technical details
The vulnerability is an integer overflow in WinPR's Stream_EnsureRemainingCapacity function triggered by a WebSocket Ping frame with a crafted 64-bit extended payload length (0xFFFFFFFFFFFFFBFF). Two unchecked size_t additions cause wraparound, resulting in a call to realloc(buffer, 0) which frees memory without clearing the pointer. On glibc systems, a subsequent realloc attempt triggers a detected double free (SIGABRT); on musl libc, the capacity becomes 0 and a subsequent memset underflows into out-of-bounds memory (SIGSEGV). The flaw is reachable pre-authentication from any RD Gateway peer and affects FreeRDP versions 3.23.0 through 3.30.0. The fix is available in version 3.31.0.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: Version 3.31.0 released with fix