CVE-2026-91952 Overview
CVE-2026-91952 is an infinite-loop denial of service vulnerability in FreeRDP versions before 3.31.0. The flaw resides in the pool_decode_rect function, which processes AVC444 metablocks during graphics decoding. When a malicious Remote Desktop Protocol (RDP) server sends AVC444 graphics updates containing more region rectangles than the preallocated worker array size, the threaded decode path enters an infinite loop. The client consumes CPU indefinitely and can no longer perform normal operations. The vulnerability is tracked as CWE-835: Loop with Unreachable Exit Condition.
Critical Impact
A malicious RDP server can render connecting FreeRDP clients unresponsive by triggering unbounded CPU consumption in the AVC444 decode path.
Affected Products
- FreeRDP versions prior to 3.31.0
- Applications and distributions bundling vulnerable FreeRDP client libraries
- Any client-side software that connects to untrusted RDP servers using FreeRDP
Discovery Timeline
- 2026-09-15 - CVE-2026-91952 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91952
Vulnerability Analysis
The defect lives in the pool_decode_rect code path used to decode AVC444 metablocks. FreeRDP preallocates a worker array sized to handle an expected number of region rectangles. When a server advertises more rectangles than the array can hold, the threaded dispatch loop fails to advance past the boundary and reprocesses work items instead of exiting. The result is a tight loop that pegs one or more CPU cores.
Because the vulnerable code runs on the RDP client side during graphics update processing, exploitation requires only that a user initiate a session with an attacker-controlled server. No authentication is required on the server, and no memory corruption occurs. The impact is availability loss for the client process and, in shared environments, degraded system responsiveness.
Root Cause
The root cause is a missing bounds check between the number of AVC444 region rectangles supplied by the peer and the size of the internal worker array used to dispatch decode tasks. Without validation, the loop iterator cannot reach its terminating condition, satisfying the CWE-835 pattern.
Attack Vector
Exploitation is network-based and requires user interaction: a user must connect to a malicious or compromised RDP server using a vulnerable FreeRDP client. Once the RDP session negotiates AVC444 graphics support, the server issues crafted graphics updates containing an oversized rectangle count. The client-side decoder then loops indefinitely.
No proof-of-concept exploit code is publicly referenced in the advisories. Technical detail is available in the FreeRDP GitHub Security Advisory GHSA-m85m-3qxv-63h5 and the VulnCheck Advisory on FreeRDP.
Detection Methods for CVE-2026-91952
Indicators of Compromise
- Sustained high CPU usage by FreeRDP client processes such as xfreerdp or wlfreerdp shortly after connecting to an RDP server.
- FreeRDP client sessions that stop rendering updates and become unresponsive while the process remains alive.
- Outbound RDP (TCP/3389) connections to unexpected or untrusted destinations followed by client hangs.
Detection Strategies
- Inventory installed FreeRDP binaries and libraries across endpoints and compare versions against 3.31.0.
- Alert on FreeRDP client processes exceeding sustained CPU thresholds (for example, one core saturated for longer than 60 seconds).
- Correlate RDP client hangs with concurrent outbound sessions to non-corporate RDP endpoints.
Monitoring Recommendations
- Monitor process telemetry for freerdp-family binaries, capturing CPU utilization and thread counts.
- Log outbound TCP/3389 connections initiated from user endpoints and flag connections to destinations outside approved RDP infrastructure.
- Track software inventory changes so newly deployed FreeRDP builds are evaluated against the fixed version.
How to Mitigate CVE-2026-91952
Immediate Actions Required
- Upgrade all FreeRDP installations to version 3.31.0 or later.
- Audit third-party applications that embed FreeRDP libraries and apply vendor updates that incorporate the fix.
- Restrict outbound RDP connections from user endpoints to a known list of trusted servers.
Patch Information
The issue is fixed in FreeRDP 3.31.0. Refer to the FreeRDP GitHub Security Advisory GHSA-m85m-3qxv-63h5 for the patched commits and release notes. Linux distributions should track their downstream FreeRDP package updates and apply them once available.
Workarounds
- Avoid initiating FreeRDP sessions to untrusted or unverified RDP servers until the patch is applied.
- Disable AVC444 graphics negotiation on the client where configuration allows, forcing fallback to alternative codecs.
- Enforce egress firewall rules that limit RDP client traffic to approved destinations only.
# Verify the installed FreeRDP client version
xfreerdp --version
# Example: connect while disabling GFX/AVC negotiation as a temporary mitigation
xfreerdp /v:<trusted-server> /gfx:off /rfx-mode:video-off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
