CVE-2026-91950: FreeRDP Buffer Overflow Vulnerability

CVE-2026-91950 Overview

CVE-2026-91950 is an out-of-bounds read vulnerability in FreeRDP versions before 3.31.0. The flaw resides in the rdpdr_dump_packet function, which handles Remote Desktop Protocol Device Redirection (RDPDR) packet dumping. A 32-bit unsigned integer wraparound in buffer bounds validation lets a malicious RDP server send a crafted packet with computerNameLen set to 0xFFFFFFF0. This value bypasses length checks and causes the client to read memory past the packet buffer. The result is either a client crash or disclosure of heap contents through log output. The issue is tracked as [CWE-125] Out-of-Bounds Read.

Critical Impact
A malicious RDP server can crash connected FreeRDP clients or leak heap memory contents into client logs, exposing potentially sensitive process data.

Affected Products

FreeRDP versions prior to 3.31.0
Applications and desktop clients that embed the vulnerable FreeRDP library
Downstream distributions packaging FreeRDP below 3.31.0

Discovery Timeline

2026-09-15 - CVE-2026-91950 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91950

Vulnerability Analysis

The vulnerability lives in the rdpdr_dump_packet function within the RDPDR channel handler of FreeRDP. RDPDR is the Microsoft protocol extension that redirects client-side devices such as printers, drives, and smart cards to the RDP server. During packet processing, the routine reads a computerNameLen field supplied by the server and uses it to bound subsequent memory reads.

Because bounds validation uses 32-bit unsigned arithmetic, an attacker-controlled length near the UINT32_MAX boundary wraps around when combined with header offsets. The wrapped value satisfies the length check while still pointing far beyond the allocated buffer. The dump routine then reads memory outside the packet, either crashing the client on unmapped pages or copying adjacent heap bytes into log output.

Root Cause

The root cause is unchecked 32-bit unsigned integer arithmetic in the buffer bounds validation logic. When computerNameLen equals 0xFFFFFFF0, adding small header offsets wraps the sum past 2^32, producing a small value that appears valid. The subsequent read operation uses the original unwrapped length, exceeding the actual buffer size.

Attack Vector

Exploitation requires a victim to connect a vulnerable FreeRDP client to an attacker-controlled or compromised RDP server. User interaction is required to initiate the connection. Once connected, the malicious server sends a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0. The client performs the out-of-bounds read during packet dumping, producing a crash or writing adjacent heap memory into diagnostic logs. See the FreeRDP GitHub Security Advisory and the VulnCheck Advisory for protocol-level detail.

Detection Methods for CVE-2026-91950

Indicators of Compromise

FreeRDP client processes terminating unexpectedly shortly after connecting to an external RDP server
Client log files containing unusually large or binary content in the RDPDR computerName field dump output
Outbound RDP sessions (TCP/3389) to untrusted or previously unseen destinations followed by client crashes

Detection Strategies

Inspect RDPDR client-announce or server-announce packets for computerNameLen values approaching 0xFFFFFFF0 or other high UINT32 boundary values
Correlate FreeRDP process crashes (xfreerdp, wlfreerdp, embedded clients) with recent outbound RDP session establishment events
Hunt for FreeRDP binaries in the environment reporting a version string below 3.31.0

Monitoring Recommendations

Alert on FreeRDP client crash signatures and abnormal termination in endpoint telemetry
Monitor outbound RDP traffic from workstations to untrusted networks and flag connections to non-corporate RDP endpoints
Review FreeRDP log directories for oversized dump entries that may contain leaked heap memory

How to Mitigate CVE-2026-91950

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all endpoints and in all applications embedding the library
Inventory downstream products that bundle FreeRDP and apply vendor updates as they ship the fixed version
Restrict outbound RDP connections from client systems to trusted, corporate-managed RDP servers only

Patch Information

The fix is included in FreeRDP 3.31.0. Details are published in the FreeRDP GitHub Security Advisory GHSA-c5gr-hmqp-pwj4. Package maintainers for major Linux distributions typically backport FreeRDP security fixes, so administrators should also check distribution advisories for updated packages.

Workarounds

Avoid connecting FreeRDP clients to untrusted or attacker-controlled RDP servers until patched
Disable device redirection features that rely on the RDPDR channel where operationally feasible
Reduce verbosity of FreeRDP client logging to limit heap contents written to disk if a crafted packet is received

bash

# Verify installed FreeRDP version
xfreerdp --version

# Example: disable device redirection channels at connect time
xfreerdp /v:<server> -drives -printers -smartcard -serial -parallel