CVE-2026-91959: FreeRDP Buffer Overflow Vulnerability

CVE-2026-91959 Overview

CVE-2026-91959 is a buffer over-read vulnerability in FreeRDP versions prior to 3.31.0. The flaw resides in the rts_read_result function within the RPC gateway transport parser. A remote attacker can send a malicious BIND_ACK Protocol Data Unit (PDU) containing a truncated result entry. Parsing this crafted PDU triggers an out-of-bounds read [CWE-125] that causes the FreeRDP client process to abort. The issue affects clients that connect through the Remote Desktop Gateway (RPC over HTTP) transport.

Critical Impact
A remote server or man-in-the-middle attacker can crash any FreeRDP client that negotiates an RPC gateway session, producing a denial-of-service condition against remote desktop users.

Affected Products

FreeRDP versions before 3.31.0
Applications embedding the FreeRDP library for RDP connectivity
Clients using the RPC-over-HTTP Remote Desktop Gateway transport

Discovery Timeline

2026-09-15 - CVE-2026-91959 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91959

Vulnerability Analysis

FreeRDP is an open-source implementation of the Microsoft Remote Desktop Protocol (RDP). It supports connections through the Remote Desktop Gateway using RPC over HTTP, which relies on the Request-to-Send (RTS) PDU exchange to establish tunnels. During connection setup, the client parses a BIND_ACK PDU returned by the gateway. The rts_read_result function processes result entries embedded in that PDU but fails to fully validate the declared length against the remaining buffer.

When a result entry is truncated, the parser reads past the end of the received data. The out-of-bounds read causes the process to abort, terminating any active or pending RDP session. Exploitation requires user interaction to initiate a connection to the malicious or compromised gateway.

Root Cause

The root cause is missing bounds enforcement in rts_read_result when iterating over result entries within a BIND_ACK PDU. The function trusts length or count fields supplied by the peer without confirming that enough bytes remain in the parsing buffer, matching the pattern described by CWE-125: Out-of-bounds Read.

Attack Vector

Exploitation occurs over the network. An attacker operating a rogue RPC gateway, or one able to intercept and modify gateway traffic, returns a crafted BIND_ACK PDU containing a result entry shorter than its declared size. When the FreeRDP client parses the response, rts_read_result reads outside the allocated buffer and the process aborts. See the FreeRDP GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for parser-level details.

Detection Methods for CVE-2026-91959

Indicators of Compromise

Unexpected termination or abort signals from freerdp, xfreerdp, or wfreerdp client processes shortly after initiating an RDP gateway connection.
Client-side logs referencing failures in rts_read_result or malformed BIND_ACK PDU parsing.
Outbound RPC-over-HTTP sessions to unfamiliar or non-corporate Remote Desktop Gateway endpoints.

Detection Strategies

Inventory endpoints running FreeRDP or applications that statically link libfreerdp and compare installed versions against 3.31.0.
Correlate RDP gateway connection attempts with subsequent process crashes on the client host to identify targeted denial-of-service activity.
Monitor network telemetry for RPC-over-HTTP flows to gateways outside the approved allowlist.

Monitoring Recommendations

Collect crash dumps and process termination events from workstations that use FreeRDP-based remote desktop clients.
Alert on repeated FreeRDP client aborts originating from a common upstream gateway address.
Track new or unsigned FreeRDP binaries introduced to managed endpoints.

How to Mitigate CVE-2026-91959

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all managed endpoints and rebuild applications that embed the library.
Restrict outbound RPC-over-HTTP traffic so FreeRDP clients can only reach approved Remote Desktop Gateway hosts.
Advise users to avoid connecting to untrusted RDP gateways until patches are deployed.

Patch Information

The FreeRDP maintainers fixed the parser bounds check in version 3.31.0. Details are published in the FreeRDP GitHub Security Advisory GHSA-pj8w-fh79-f438. Downstream Linux distributions and third-party applications bundling FreeRDP should track updated packages that incorporate this release.

Workarounds

Disable use of the RPC gateway transport where direct RDP connectivity is available.
Enforce TLS inspection or mutual authentication on gateway paths to reduce the risk of PDU tampering by an in-path attacker.
Terminate RDP gateway sessions through trusted reverse proxies that validate protocol conformance before forwarding traffic.

bash

# Verify installed FreeRDP client version
xfreerdp --version

# Debian/Ubuntu: upgrade FreeRDP packages
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11 libfreerdp3

# Fedora/RHEL: upgrade FreeRDP packages
sudo dnf upgrade freerdp libfreerdp