CVE-2026-91960: FreeRDP Integer Overflow DOS Vulnerability

CVE-2026-91960 Overview

CVE-2026-91960 is an integer overflow vulnerability in FreeRDP versions before 3.31.0. The flaw resides in the Stream_EnsureRemainingCapacity function within WinPR, FreeRDP's Windows Portable Runtime library. A malicious Remote Desktop (RD) Gateway peer can send a WebSocket Ping frame containing a crafted 64-bit extended payload length. The oversized value triggers an integer wraparound during capacity calculation, which results in a double free condition. The double free crashes the FreeRDP client during connection establishment, producing a denial of service against users attempting to reach a compromised or attacker-controlled gateway.

Critical Impact
Remote attackers operating a malicious RD Gateway can crash connecting FreeRDP clients through a single crafted WebSocket Ping frame, disrupting Remote Desktop access.

Affected Products

FreeRDP versions prior to 3.31.0
WinPR library shipped with affected FreeRDP releases
Applications and distributions embedding vulnerable FreeRDP client components

Discovery Timeline

2026-09-15 - CVE-2026-91960 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91960

Vulnerability Analysis

The vulnerability is an integer overflow [CWE-190] in FreeRDP's stream capacity management. Stream_EnsureRemainingCapacity is responsible for growing an internal buffer when incoming data exceeds the currently allocated space. When the function processes a WebSocket frame from an RD Gateway peer, it trusts the 64-bit extended payload length declared in the frame header. A crafted length near the unsigned 64-bit boundary causes the arithmetic used to compute the new buffer size to wrap around to a small value. The undersized allocation, combined with subsequent free operations on stream buffers, leads to a double free. FreeRDP terminates when the memory allocator detects the corruption, producing a denial of service against the client.

Root Cause

The root cause is missing overflow validation on attacker-controlled length fields before they are used in size arithmetic. WinPR does not verify that the WebSocket extended payload length remains within safe bounds relative to existing buffer size and pointer arithmetic. The subsequent memory management logic operates on inconsistent state, freeing the same allocation twice.

Attack Vector

Exploitation requires user interaction: a victim must initiate a FreeRDP connection to an attacker-controlled or compromised RD Gateway. Once the WebSocket handshake completes, the malicious gateway sends a Ping frame with the crafted 64-bit extended payload length. No authentication is required, and the attack succeeds over the network. Impact is limited to availability of the FreeRDP client process. See the FreeRDP GitHub Security Advisory and the VulnCheck Advisory on FreeRDP for further technical detail.

Detection Methods for CVE-2026-91960

Indicators of Compromise

Unexpected FreeRDP client crashes shortly after initiating connections to RD Gateway endpoints
Core dumps or crash reports referencing Stream_EnsureRemainingCapacity or double free detection in the WinPR allocator
Outbound RD Gateway connections to unfamiliar or newly registered domains handling WebSocket traffic

Detection Strategies

Monitor endpoint telemetry for repeated abnormal termination of xfreerdp, wfreerdp, or embedded FreeRDP processes
Inspect network traffic for RD Gateway WebSocket sessions carrying Ping frames with extended payload length fields set to unusually large 64-bit values
Correlate FreeRDP crash events with the destination gateway address to identify malicious peers

Monitoring Recommendations

Track FreeRDP and WinPR versions across managed workstations to identify hosts still running builds prior to 3.31.0
Alert on outbound RDP or RD Gateway sessions to destinations outside approved allowlists
Retain process crash telemetry and network metadata for RD Gateway sessions to support post-incident analysis

How to Mitigate CVE-2026-91960

Immediate Actions Required

Upgrade FreeRDP and any bundled WinPR components to version 3.31.0 or later on all client systems
Restrict outbound RD Gateway connections to trusted, organization-managed gateway endpoints
Instruct users to avoid connecting to unknown or untrusted RD Gateway hosts until patching is complete

Patch Information

The FreeRDP project fixed the integer overflow in release 3.31.0 by validating the WebSocket extended payload length before performing capacity arithmetic in Stream_EnsureRemainingCapacity. Refer to the FreeRDP GitHub Security Advisory for commit references and downstream distribution updates.

Workarounds

Block or filter FreeRDP client connections to RD Gateway hosts that are not explicitly allowlisted
Use network segmentation to prevent workstations from reaching arbitrary internet-facing RD Gateway endpoints
Where patching is delayed, replace vulnerable FreeRDP clients with alternative RDP clients until an upgrade to 3.31.0 is deployed

bash

# Verify installed FreeRDP version and upgrade on Debian/Ubuntu
xfreerdp --version
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11