CVE-2026-91948: FreeRDP Buffer Overflow Vulnerability

CVE-2026-91948 Overview

CVE-2026-91948 is an out-of-bounds write vulnerability in FreeRDP versions before 3.31.0. The flaw resides in server-side static virtual channel handling when the CHANNEL_OPTION_SHOW_PROTOCOL flag is enabled. Authenticated clients can queue oversized channel messages that trigger a buffer underflow and corrupt heap memory, including live pointers. Heap corruption of this nature can enable arbitrary code execution against the FreeRDP server process. The vulnerability is tracked under CWE-191: Integer Underflow and requires an authenticated Remote Desktop Protocol (RDP) session to exploit.

Critical Impact
Authenticated attackers can corrupt heap memory in FreeRDP server processes, potentially leading to remote code execution on systems running vulnerable FreeRDP builds.

Affected Products

FreeRDP versions prior to 3.31.0
FreeRDP server components using static virtual channels
Applications and services embedding vulnerable FreeRDP libraries

Discovery Timeline

2026-09-15 - CVE-2026-91948 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91948

Vulnerability Analysis

The vulnerability exists in libfreerdp/core/server.c, which handles server-side static virtual channel messaging in FreeRDP. When CHANNEL_OPTION_SHOW_PROTOCOL is negotiated, the server prepends protocol header bytes to outbound channel data. An arithmetic calculation involving the client-supplied message size produces a value that underflows the expected buffer boundary. The underflowed size is then used as a write length, causing the process to write beyond the allocated buffer and into adjacent heap memory. Because heap regions in a long-running RDP server typically contain live pointers and control structures, corruption can be steered toward code execution rather than a simple crash.

Root Cause

The root cause is an integer underflow (CWE-191) in the size computation for channel messages. The original code declared the working size as const size_t size = s;, preventing later re-clamping when the computed offset exceeded the incoming buffer length. Without the ability to reassign size, the write path used an unchecked value that wrapped past zero when subtracted, producing an unexpectedly large length parameter for downstream memory operations.

Attack Vector

Exploitation requires an authenticated RDP session against a FreeRDP-based server with CHANNEL_OPTION_SHOW_PROTOCOL enabled. The attacker negotiates a static virtual channel, then submits crafted channel data of a size that triggers the underflow during server-side reassembly. The resulting out-of-bounds write corrupts heap-resident pointers and metadata within the FreeRDP process. Successful exploitation can transition heap corruption into code execution in the context of the RDP server.

// Patch: libfreerdp/core/server.c
                                   size_t s, UINT32 flags, size_t t)
 {
 	BOOL ret = TRUE;
-	const size_t size = s;
+	size_t size = s;
 	const size_t totalSize = t;
 
 	WINPR_ASSERT(channel);

Source: FreeRDP commit 40d9202. The patch removes the const qualifier so that size can be safely reassigned during bounds validation, preventing the underflowed value from reaching write operations.

Detection Methods for CVE-2026-91948

Indicators of Compromise

Unexpected crashes or segmentation faults in FreeRDP server processes correlated with authenticated RDP sessions
Anomalous static virtual channel messages with oversized or malformed length fields
Post-authentication RDP sessions immediately followed by spawning of shell or scripting processes under the FreeRDP service account

Detection Strategies

Inventory hosts running FreeRDP-based services and compare installed versions against 3.31.0 or later
Enable core dumps for FreeRDP server processes and inspect crash addresses within libfreerdp/core/server.c code paths
Correlate RDP authentication events with process crashes or child-process creation on the RDP host

Monitoring Recommendations

Monitor RDP-facing hosts for repeated session establishment followed by service restarts of FreeRDP components
Log and alert on virtual channel negotiations that include CHANNEL_OPTION_SHOW_PROTOCOL on exposed servers
Track outbound network activity from FreeRDP server processes that deviates from normal RDP session behavior

How to Mitigate CVE-2026-91948

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all affected servers and downstream applications
Restrict RDP server exposure to trusted networks and require strong authentication to limit access to the vulnerable code path
Audit third-party products that bundle FreeRDP and apply vendor updates as they become available

Patch Information

The fix is included in FreeRDP 3.31.0 and is available in the upstream commit 40d9202cd95551600c07437ce6bd5ecd7d31e57b. Additional context is available in the GitHub Security Advisory GHSA-9jcm-x588-gh26 and the VulnCheck advisory.

Workarounds

Disable server configurations that negotiate CHANNEL_OPTION_SHOW_PROTOCOL on static virtual channels until patching is complete
Place FreeRDP servers behind a VPN or bastion host to reduce authenticated attack surface
Enforce least privilege on the service account running FreeRDP to limit post-exploitation impact

bash

# Verify installed FreeRDP version
freerdp-shadow-cli --version
xfreerdp --version

# Example: build and install FreeRDP 3.31.0 or later from source
git clone --branch 3.31.0 https://github.com/FreeRDP/FreeRDP.git
cd FreeRDP
cmake -B build -DCMAKE_BUILD_TYPE=Release
cmake --build build --parallel
sudo cmake --install build