CVE-2026-91945: FreeRDP Buffer Overflow Vulnerability

CVE-2026-91945 Overview

CVE-2026-91945 is an out-of-bounds read vulnerability [CWE-125] affecting FreeRDP versions before 3.31.0. The flaw resides in the smartcard response decoders, which fail to validate Answer To Reset (ATR) length fields against fixed inline arrays. An authenticated RDP server can send oversized ATR lengths in PAKID_CORE_DEVICE_IOCOMPLETION responses to trigger reads past stack or heap object boundaries. The condition causes process termination of the FreeRDP client, resulting in a denial-of-service scenario.

Critical Impact
Authenticated attackers on a network path can crash FreeRDP clients by sending crafted smartcard channel responses, disrupting remote desktop sessions and workflows that depend on FreeRDP.

Affected Products

FreeRDP versions prior to 3.31.0
FreeRDP client implementations using the smartcard channel
Applications and distributions bundling vulnerable FreeRDP libraries

Discovery Timeline

2026-09-15 - CVE-2026-91945 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91945

Vulnerability Analysis

The vulnerability affects FreeRDP's smartcard virtual channel handling. FreeRDP exposes smartcard readers to the remote session using the RDP device redirection protocol. Responses from the server carry ATR data, which describes smartcard reader capabilities.

The decoder functions copy ATR bytes into fixed-size buffers without verifying that the declared length fits within the destination. When a PAKID_CORE_DEVICE_IOCOMPLETION response advertises an oversized ATR length, the decoder reads past the bounds of the inline array. The read walks into adjacent stack or heap memory, and the process terminates when it encounters an unreadable page or triggers memory-safety instrumentation.

Root Cause

The root cause is missing bounds validation on attacker-controlled length fields before consumption. The decoder treats the length as trusted and iterates against the inline buffer size only after the read has already occurred. This is a classic input validation failure aligned with [CWE-125].

Attack Vector

Exploitation requires an authenticated RDP session with the client. A malicious or compromised RDP server injects a crafted smartcard IO completion response into an active session. No user interaction is required beyond initiating the RDP session. The impact is limited to availability of the FreeRDP client process. Confidentiality and integrity are not affected based on the published assessment.

The upstream fix is available in commit 9626564421df72c84f891afdbc0b20bf702f369f. See the GitHub FreeRDP Commit, GitHub Security Advisory GHSA-q65v-4w7q-hx3r, and the VulnCheck FreeRDP Advisory for technical details.

Detection Methods for CVE-2026-91945

Indicators of Compromise

Unexpected FreeRDP client crashes during smartcard redirection or authentication phases
Core dumps or Windows Error Reporting entries referencing FreeRDP smartcard channel modules
RDP session terminations correlated with server responses on the RDPDR device redirection channel

Detection Strategies

Inventory FreeRDP installations and library dependencies across endpoints and identify versions prior to 3.31.0
Monitor for abnormal termination of processes linking libfreerdp or libwinpr shared libraries
Inspect RDP traffic captures for smartcard IO completion packets with anomalous ATR length fields

Monitoring Recommendations

Alert on repeated FreeRDP client process crashes originating from the same remote host
Log outbound RDP connections to untrusted or unmanaged servers and review sessions using smartcard redirection
Track patch compliance for FreeRDP across Linux distribution package managers and third-party bundles

How to Mitigate CVE-2026-91945

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all client systems
Rebuild or update any application that statically links or bundles FreeRDP libraries
Restrict outbound RDP connections to trusted, managed servers only

Patch Information

The fix is included in FreeRDP 3.31.0 and tracked in upstream commit 9626564421df72c84f891afdbc0b20bf702f369f. The patch adds validation of ATR length fields against the destination buffer size before decoding. Refer to GitHub Security Advisory GHSA-q65v-4w7q-hx3r for the coordinated advisory. The realCodeExample provided in the enriched data covers build system changes in winpr/CMakeLists.txt from the same merge and is not the security-relevant hunk.

Workarounds

Disable smartcard redirection when connecting to untrusted servers by omitting the /smartcard command-line option
Limit RDP connectivity to internal networks using firewall egress rules until patched clients are deployed
Isolate high-risk RDP client hosts in a segmented network zone to reduce exposure to malicious servers

bash

# Configuration example: connect without smartcard redirection
xfreerdp /v:rdp.example.internal /u:user /cert:tofu

# Verify installed FreeRDP version meets the fixed release
xfreerdp --version
# Expected: FreeRDP 3.31.0 or later