CVE-2026-91953 Overview
CVE-2026-91953 is a heap buffer overflow [CWE-120] in FreeRDP versions prior to 3.31.0. The flaw resides in the nego_send_negotiation_request() function, which fails to validate the length of the LB_LOAD_BALANCE_INFO field before copying it into a fixed 512-byte buffer. A malicious Remote Desktop Protocol (RDP) server, or an attacker positioned as a man-in-the-middle, can send a crafted Server Redirection Protocol Data Unit (PDU) to trigger the overflow. Exploitation occurs before authentication completes and can result in denial of service or heap corruption on the connecting client.
Critical Impact
Attackers can corrupt heap memory in FreeRDP clients pre-authentication by supplying an oversized LB_LOAD_BALANCE_INFO value, enabling denial of service and potential further exploitation.
Affected Products
- FreeRDP versions prior to 3.31.0
- Applications and distributions bundling vulnerable FreeRDP libraries
- RDP client integrations relying on the nego negotiation subsystem
Discovery Timeline
- 2026-09-15 - CVE-2026-91953 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91953
Vulnerability Analysis
The vulnerability originates in the RDP connection negotiation path of FreeRDP. During redirection handling, the client parses a Server Redirection PDU that may contain an LB_LOAD_BALANCE_INFO field. The nego_send_negotiation_request() function copies this attacker-supplied field into a fixed-size 512-byte buffer without enforcing a length check. When the field exceeds 512 bytes, the write overflows the heap allocation and corrupts adjacent memory.
Because the overflow occurs before authentication is completed, no credentials are required to reach the vulnerable code path. Exploitation requires a user to initiate an RDP connection to a hostile endpoint or to be redirected through a network attacker in a man-in-the-middle position. Successful exploitation causes process crashes and may allow further memory corruption depending on heap layout.
Root Cause
The root cause is missing input validation on a variable-length protocol field. The FreeRDP negotiation code assumes LB_LOAD_BALANCE_INFO fits within a statically allocated 512-byte buffer. The absence of a bounds check between the declared field length and the destination buffer size permits the copy operation to write past the buffer boundary, producing a classic heap-based buffer overflow.
Attack Vector
Exploitation requires network reachability to the FreeRDP client and user interaction to initiate an RDP session. An attacker controls a malicious RDP server or intercepts session traffic and returns a Server Redirection PDU that carries an oversized LB_LOAD_BALANCE_INFO value. The client processes the PDU during negotiation and triggers the overflow before authentication finishes. Refer to the GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for protocol-level details.
No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the upstream security advisory.
Detection Methods for CVE-2026-91953
Indicators of Compromise
- FreeRDP client processes crashing or terminating unexpectedly shortly after initiating an RDP session
- RDP sessions redirected to unfamiliar or untrusted destination hosts during connection setup
- Server Redirection PDUs containing LB_LOAD_BALANCE_INFO fields larger than 512 bytes observed on the wire
Detection Strategies
- Inventory endpoints for FreeRDP binaries and libraries below version 3.31.0 using software composition analysis
- Inspect RDP traffic at network egress points for anomalously large redirection PDUs
- Correlate FreeRDP crash telemetry with recent outbound RDP connections to non-corporate destinations
Monitoring Recommendations
- Enable process crash and exception logging on hosts running FreeRDP-based clients
- Log outbound TCP/3389 and RDP-over-TLS connections and alert on connections to unmanaged infrastructure
- Monitor package management events for FreeRDP updates to confirm patch adoption across fleets
How to Mitigate CVE-2026-91953
Immediate Actions Required
- Upgrade FreeRDP to version 3.31.0 or later on all affected systems
- Identify and patch downstream applications and Linux distribution packages that embed vulnerable FreeRDP builds
- Restrict outbound RDP traffic to trusted destinations through firewall or proxy policies
Patch Information
The FreeRDP project addressed the vulnerability in version 3.31.0 by adding length validation for the LB_LOAD_BALANCE_INFO field before it is copied into the 512-byte buffer. Consult the GitHub Security Advisory for the commit reference and vendor package tracking.
Workarounds
- Avoid initiating RDP connections to untrusted or unverified servers until patched
- Disable or block RDP redirection at network boundaries where feasible
- Enforce TLS-based RDP transport with strict certificate validation to reduce man-in-the-middle exposure
# Verify installed FreeRDP client version
xfreerdp --version
# Example: upgrade FreeRDP on Debian-based systems after distribution patch
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
