CVE-2026-91964

Analyzed Analyzed - Analysis Complete

Heap-based Buffer Overflow in FreeRDP

Publication date: 2026-09-15

Last updated on: 2026-11-03

Assigner: VulnCheck

Description

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-09-15

EPSS Evaluated

2026-11-07

NVD

CVE-2026-91964

EUVD

EUVD-2026-78640

Affected Vendors & Products

Vendor	Product	Version / Range
freerdp	freerdp	to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-122	A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

Executive Summary

CVE-2026-91964 is a heap-based buffer overflow in FreeRDP versions before 3.31.0. It occurs in the nego_send_negotiation_request function when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can send an arbitrary-length field that overflows a fixed 512-byte buffer without validation, causing client crashes or potential code execution if combined with memory disclosure.

Detection Guidance

To detect this vulnerability, check FreeRDP versions on your system using commands like 'xfreerdp --version' or 'apt list --installed | grep freerdp' for Debian-based systems. Monitor network traffic for RDP connections with unusually large LoadBalanceInfo fields in Server Redirection PDU messages. Inspect logs for crashes or memory corruption errors in FreeRDP-related applications.

Impact Analysis

This vulnerability can allow a malicious RDP server to crash your FreeRDP client or potentially execute arbitrary code on your system. It requires no user interaction or credentials, making it exploitable remotely. Affected clients include Remmina, GNOME Connections, KRDC, and Apache Guacamole if they use vulnerable libfreerdp versions.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data breaches, violating confidentiality and integrity requirements under GDPR and HIPAA. Organizations using vulnerable FreeRDP versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. If upgrading is not possible, disable RDP connections or restrict access to trusted servers only. Apply network-level mitigations such as firewalls to block malicious RDP traffic. Monitor for unusual activity or crashes in FreeRDP clients.

Hi! I’m here to help you understand CVE-2026-91964. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...