CVE-2026-91955: FreeRDP GCC Negotiation DoS Vulnerability

CVE-2026-91955 Overview

CVE-2026-91955 is a denial-of-service vulnerability in FreeRDP versions before 3.31.0. The flaw resides in the Generic Conference Control (GCC) negotiation phase of the Remote Desktop Protocol (RDP) handshake. FreeRDP fails to validate client-supplied DesktopWidth and DesktopHeight values, allowing a remote unauthenticated attacker to submit crafted dimensions of zero or oversized values. These values propagate into multifragment update capability calculations, where they trigger a division-by-zero or assertion failure. The result is termination of the server process. The weakness is classified under [CWE-369: Divide By Zero].

Critical Impact
Unauthenticated remote attackers can crash any FreeRDP-based server by sending a single malformed RDP packet during connection negotiation.

Affected Products

FreeRDP versions prior to 3.31.0
Applications and services embedding vulnerable FreeRDP server components
Downstream Linux distributions packaging affected FreeRDP releases

Discovery Timeline

2026-09-15 - CVE-2026-91955 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91955

Vulnerability Analysis

The vulnerability occurs during the initial RDP connection sequence. A client sends a Generic Conference Control (GCC) Conference Create Request containing client core data. This structure includes DesktopWidth and DesktopHeight fields that describe the requested display resolution. FreeRDP accepts these fields without bounds checking. The server subsequently uses these dimensions to compute internal buffer sizes for multifragment update capability. When an attacker supplies zero or extreme values, the calculation either divides by zero or violates an assertion, and the FreeRDP server process terminates. Since the flaw is reached before authentication, any exposed FreeRDP server is exploitable.

Root Cause

The root cause is missing input validation on untrusted, client-supplied protocol fields. FreeRDP treats the desktop geometry advertised by the client as trustworthy input and performs arithmetic on it without range or zero checks. This maps to [CWE-369] where a numeric input reaches a division operator without prior sanitization.

Attack Vector

Exploitation requires network access to a listening FreeRDP server. The attacker establishes a TCP connection to the RDP port and initiates the standard connection sequence. During GCC negotiation, the attacker sends a crafted client core data block with DesktopWidth or DesktopHeight set to zero or to a value large enough to break capability math. The server process aborts. No credentials, user interaction, or prior foothold are required. Refer to the GitHub Security Advisory GHSA-4464 and the VulnCheck FreeRDP DoS Advisory for protocol-level details.

Detection Methods for CVE-2026-91955

Indicators of Compromise

Unexpected termination or crash logs from FreeRDP server processes shortly after inbound RDP connections
Core dumps or SIGABRT signals originating from FreeRDP binaries
Repeated short-lived TCP sessions to RDP listeners from a single source address followed by service restarts
Aborted GCC Conference Create Request sequences in packet captures

Detection Strategies

Inspect RDP GCC negotiation traffic for DesktopWidth or DesktopHeight values of zero or values exceeding realistic display bounds
Correlate FreeRDP process exit events with preceding inbound RDP connection attempts
Alert on repeated crash-restart cycles of RDP server services across short time windows

Monitoring Recommendations

Forward FreeRDP server logs, systemd service state changes, and crash telemetry to a centralized logging platform
Monitor RDP listener availability with active probes to detect crash-induced outages
Track connection source diversity to identify scripted attempts targeting the negotiation phase

How to Mitigate CVE-2026-91955

Immediate Actions Required

Upgrade all FreeRDP installations to version 3.31.0 or later
Inventory downstream applications that embed FreeRDP server libraries and apply vendor updates as they become available
Restrict network exposure of FreeRDP services to trusted management networks until patching is complete

Patch Information

The FreeRDP project addressed the flaw in release 3.31.0 by validating client-supplied desktop dimensions during GCC negotiation. Details and fixed commits are published in the GitHub Security Advisory GHSA-4464. Administrators should rebuild or repackage any applications that statically link vulnerable FreeRDP versions.

Workarounds

Place FreeRDP servers behind an RDP-aware gateway or VPN that terminates and re-establishes sessions
Use firewall rules to limit inbound RDP connections to known administrative source addresses
Enable process supervision so that any DoS-induced crash results in automatic service restart while patching is pending

bash

# Configuration example: restrict inbound RDP to a management subnet
sudo iptables -A INPUT -p tcp --dport 3389 -s 10.0.10.0/24 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 3389 -j DROP