CVE-2026-91964: FreeRDP Heap Buffer Overflow Vulnerability

CVE-2026-91964 Overview

CVE-2026-91964 is a heap-based buffer overflow [CWE-122] in FreeRDP versions before 3.31.0. The flaw resides in the nego_send_negotiation_request function during processing of Server Redirection Protocol Data Unit (PDU) messages. A malicious Remote Desktop Protocol (RDP) server can supply an arbitrary-length LoadBalanceInfo field that gets copied into a fixed 512-byte buffer without length validation. Exploitation causes client crashes and can lead to code execution when chained with a memory disclosure primitive. FreeRDP is widely embedded in Linux desktops, thin clients, and remote access tools, expanding the exposure surface for downstream projects.

Critical Impact
A hostile RDP server can corrupt heap memory on any connecting FreeRDP client, enabling denial of service and potential remote code execution against workstations and thin clients.

Affected Products

FreeRDP versions 2.0.0 through 3.30.0
Downstream applications embedding vulnerable FreeRDP libraries (Remmina, xrdp clients, Weston RDP backend)
Linux and Unix distributions shipping affected libfreerdp packages

Discovery Timeline

2026-09-15 - CVE-2026-91964 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91964

Vulnerability Analysis

The defect lives in FreeRDP's negotiation path, specifically in nego_send_negotiation_request. When a client processes a Server Redirection PDU, it extracts the LoadBalanceInfo field (also referenced as RoutingToken) supplied by the server. The routine copies this attacker-controlled data into a fixed 512-byte stack- or heap-adjacent buffer without verifying the source length. Any field larger than 512 bytes overflows the destination allocation and corrupts adjacent heap metadata and objects.

The issue is triggered client-side, which inverts the usual RDP threat model. Users connecting to attacker-operated or compromised RDP endpoints become the targets. User interaction is required, since a victim must initiate a session to the malicious server, but no authentication is needed on the client side to reach the vulnerable code path.

Root Cause

The root cause is missing bounds checking on a length field controlled by the remote peer. FreeRDP trusted the server-supplied LoadBalanceInfo size instead of clamping the copy operation to the 512-byte destination. This pattern, classified under [CWE-122] Heap-Based Buffer Overflow, allows adjacent heap chunks to be overwritten with attacker data.

Attack Vector

Exploitation requires an attacker to operate an RDP server and lure a FreeRDP client to connect. Common delivery methods include phishing links containing .rdp files, DNS or ARP redirection on shared networks, or man-in-the-middle interception of legitimate RDP sessions. Once the client connects, the server responds with a crafted Redirection PDU containing an oversized LoadBalanceInfo value, corrupting client heap memory during negotiation. Chaining the overflow with an information disclosure primitive can yield arbitrary code execution in the context of the RDP client process.

The vulnerability is described in prose only; refer to the GitHub Security Advisory GHSA-2vf2-grvj-6g8x and the VulnCheck FreeRDP Heap Overflow Advisory for further technical detail.

Detection Methods for CVE-2026-91964

Indicators of Compromise

Unexpected crashes or segmentation faults in xfreerdp, wlfreerdp, or applications linking libfreerdp shortly after establishing an outbound RDP session.
Outbound RDP connections (TCP/3389) from user workstations to untrusted or newly observed external hosts.
Core dumps referencing nego_send_negotiation_request or heap corruption abort messages such as malloc_consolidate(): invalid chunk size.

Detection Strategies

Inventory installed FreeRDP packages across Linux endpoints and flag versions below 3.31.0 using package managers like dpkg, rpm, or pacman.
Deploy network detection rules that identify RDP Redirection PDUs containing LoadBalanceInfo fields larger than 512 bytes.
Correlate process crashes of RDP client binaries with recent outbound RDP session establishment in endpoint telemetry.

Monitoring Recommendations

Log all outbound RDP connections initiated by user endpoints and alert on connections to hosts outside approved destination lists.
Monitor for delivery of .rdp configuration files via email, chat, and download proxies.
Enable core dump collection for RDP client processes to accelerate triage of suspected exploitation attempts.

How to Mitigate CVE-2026-91964

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all affected endpoints and rebuild any downstream software statically linked against libfreerdp.
Restrict outbound RDP (TCP/3389) at the network perimeter to an allow-list of known-good internal and partner destinations.
Instruct users not to open .rdp files received from untrusted sources and block such attachments at the mail gateway.

Patch Information

The FreeRDP maintainers addressed the flaw in release 3.31.0. The fix adds length validation before copying the LoadBalanceInfo field into the fixed-size destination buffer. Distribution maintainers are shipping backported patches; consult vendor advisories and the GitHub Security Advisory GHSA-2vf2-grvj-6g8x for updated package versions.

Workarounds

Disable server redirection handling in FreeRDP clients where the feature is not required by operational workflows.
Route RDP sessions through an authenticated jump host or RDP gateway that terminates and re-establishes the protocol, preventing direct exposure to untrusted servers.
Deploy application allow-listing to prevent execution of unapproved RDP client binaries and downloaded .rdp launcher files.

bash

# Verify installed FreeRDP version and upgrade on Debian/Ubuntu systems
dpkg -l | grep -E 'freerdp|libfreerdp'
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 libfreerdp2-2

# Block outbound RDP to non-approved destinations with iptables
sudo iptables -A OUTPUT -p tcp --dport 3389 -d 10.0.0.0/8 -j ACCEPT
sudo iptables -A OUTPUT -p tcp --dport 3389 -j REJECT