CVE-2026-91958: FreeRDP Buffer Overflow Vulnerability

CVE-2026-91958 Overview

CVE-2026-91958 is an out-of-bounds read and write vulnerability [CWE-125] in FreeRDP versions before 3.31.0. The flaw resides in the xf_detect_monitors function, which fails to validate MonitorIds array values when parsing Remote Desktop Protocol (RDP) connection files. An attacker can craft a malicious .rdp file containing an out-of-range selectedmonitors value. When a user opens the file with xfreerdp, the unbounded array indexing triggers heap memory corruption.

Critical Impact
A crafted RDP connection file can cause xfreerdp to perform out-of-bounds heap reads and writes, leading to process crashes or potential memory corruption when opened by a local user.

Affected Products

FreeRDP versions 3.11.0 through 3.30.0
xfreerdp X11 client component
Applications and distributions bundling vulnerable FreeRDP releases

Discovery Timeline

2026-09-15 - CVE-2026-91958 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91958

Vulnerability Analysis

The vulnerability exists in FreeRDP's monitor detection logic within the xf_detect_monitors routine. When xfreerdp parses an RDP connection file, it reads user-supplied selectedmonitors values and uses them as indices into the MonitorIds array without bounds checking. This unbounded indexing allows access to memory outside the intended heap allocation. Both read and write operations occur against attacker-controlled offsets, producing heap buffer overflow conditions on the client system.

Root Cause

The root cause is missing input validation on the MonitorIds array values supplied through the selectedmonitors field of an RDP file. FreeRDP's parser trusts the numeric values without verifying they fall within the bounds of the detected monitor set. This classifies as CWE-125 (Out-of-bounds Read), though the flaw also enables out-of-bounds writes during monitor structure population.

Attack Vector

Exploitation requires user interaction. An attacker delivers a malicious .rdp file through phishing, a compromised website, a shared file store, or another delivery channel. When the victim opens the file with xfreerdp, the client parses the malicious selectedmonitors value and triggers the out-of-bounds access. Because the attack targets the local RDP client rather than a server, the impact is limited to the machine running xfreerdp, but memory corruption within a client process can still enable code execution scenarios depending on heap layout.

No verified proof-of-concept code has been published. Technical details are documented in the FreeRDP GitHub Security Advisory and the VulnCheck FreeRDP Heap Overflow Advisory.

Detection Methods for CVE-2026-91958

Indicators of Compromise

Unexpected xfreerdp process crashes or segmentation faults following the opening of an RDP file
.rdp files containing unusually large or negative selectedmonitors values
Core dumps referencing xf_detect_monitors in the call stack
RDP connection files delivered via email attachments or downloaded from untrusted sources

Detection Strategies

Inspect .rdp files at email and web gateways for out-of-range selectedmonitors values before delivery
Monitor endpoint telemetry for xfreerdp invocations spawned from user download directories or email clients
Alert on abnormal termination of FreeRDP client processes correlated with recent file-open events
Track installed FreeRDP package versions across Linux endpoints and flag any release earlier than 3.31.0

Monitoring Recommendations

Enable auditd or equivalent process-execution logging for xfreerdp command lines and parent processes
Forward crash reports and core dump events to centralized logging for correlation with file-open activity
Maintain an inventory of workstations that use FreeRDP for remote administration and prioritize their patching

How to Mitigate CVE-2026-91958

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all systems running xfreerdp
Rebuild and redeploy any applications that statically link or bundle vulnerable FreeRDP libraries
Instruct users to avoid opening .rdp files received from untrusted sources until patches are applied
Block inbound .rdp file attachments at email security gateways where operational policy permits

Patch Information

The FreeRDP project addressed the flaw in release 3.31.0 by adding bounds validation to the MonitorIds handling in xf_detect_monitors. Refer to the FreeRDP GitHub Security Advisory GHSA-23pf-q83q-x45r for the upstream fix commit and downstream distribution guidance.

Workarounds

Restrict xfreerdp usage to RDP files generated by trusted internal tooling or administrators
Apply application allowlisting to prevent xfreerdp from being launched by mail clients or browsers
Use file-integrity and content-inspection tooling to strip or quarantine untrusted .rdp attachments

bash

# Verify installed FreeRDP version on Debian/Ubuntu systems
dpkg -l | grep -i freerdp

# Upgrade FreeRDP where a fixed package is available
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Confirm the runtime version meets or exceeds 3.31.0
xfreerdp --version