Executive brief
FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) client used to connect to Windows systems and other RDP servers. A malicious RDP server can exploit a heap buffer overflow in the negotiation phase by sending an excessively long routing token, causing the RDP client to crash or potentially execute arbitrary code if combined with another vulnerability to bypass memory protections. This affects users connecting to untrusted or compromised RDP servers.
Technical details
The vulnerability is a heap-based buffer overflow in the nego_send_negotiation_request() function within libfreerdp/core/nego.c. The root cause is that a fixed 512-byte stream buffer is allocated without capacity validation, and an attacker-controlled RoutingToken (derived from the LoadBalanceInfo field in a Server Redirection PDU) is copied into this buffer with memcpy without checking the token's length. A malicious RDP server can trigger the vulnerability by sending a redirection message with an oversized LoadBalanceInfo field; the client stores this verbatim and uses it as the RoutingToken on reconnection. The overflow overwrites adjacent heap structures, deterministically the clipboard request_table hash table on Linux desktop builds, enabling code execution through hash table callback redirection when combined with ASLR bypass techniques. The vulnerability requires no client authentication and affects FreeRDP 2.0.0 through 3.30.0; version 3.31.0 and later include a fix.
Affected products
- FreeRDP FreeRDP 2.0.0 through 3.30.0
- Remmina Remmina 1.4.x (when linked against vulnerable libfreerdp)
Timeline
- 2026-09-01: disclosed: GitHub Security Advisory GHSA-2vf2-grvj-6g8x published
- 2026-09-15: advisory: CVE-2026-91964 published on NVD
- 2026-09-15: patched: FreeRDP 3.31.0 contains fix