CVE-2026-91953
Received Received - Intake

Heap Buffer Overflow in FreeRDP

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91953
EUVD
EUVD-2026-78810

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91953 is a heap buffer overflow in FreeRDP versions before 3.31.0. It occurs in the nego_send_negotiation_request() function where the LB_LOAD_BALANCE_INFO field length is not validated before writing to a fixed 512-byte buffer. An attacker can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with malicious data before authentication completes.

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for FreeRDP connections with oversized LB_LOAD_BALANCE_INFO fields. Use Wireshark or tcpdump to capture RDP traffic and filter for Server Redirection PDUs with LB_LOAD_BALANCE_INFO values exceeding 512 bytes. Check FreeRDP version with 'xfreerdp --version' or 'apt show freerdp2-x11' to confirm if your version is below 3.31.0.

  • Wireshark filter: rdp && rdp.pdu_type == 0x0a && rdp.load_balance_info.length > 512
Impact Analysis

This vulnerability can lead to denial of service or heap corruption on affected systems. An attacker could crash the FreeRDP client or execute arbitrary code with the privileges of the user running the client. The attack is possible before authentication, meaning it can compromise systems even if no credentials are exchanged.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling unauthorized access or data exfiltration through heap corruption or denial of service before authentication. GDPR requires protection of personal data integrity and availability, while HIPAA mandates secure handling of health information. A successful exploit may violate these requirements by compromising system security.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. If upgrading is not possible, disable RDP server redirection in client configurations or block external RDP connections at the network perimeter until patched. Monitor for crashes or heap corruption in FreeRDP processes as potential exploitation signs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91953. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart