CVE-2026-91964
Received Received - Intake

Heap-based Buffer Overflow in FreeRDP

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91964
EUVD
EUVD-2026-78640

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
freerdp freerdp From 2.0.0 (inc) to 3.30.0 (inc)
remmina remmina *
gnome_connections gnome_connections *
krdc krdc *
apache_guacamole apache_guacamole *
freerdp freerdp to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-91964 is a heap-based buffer overflow in FreeRDP versions before 3.31.0. It occurs in the nego_send_negotiation_request function when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can send an arbitrary-length field that overflows a fixed 512-byte buffer without validation, causing client crashes or potential code execution if combined with memory disclosure.

Detection Guidance

To detect this vulnerability, check FreeRDP versions on your system using commands like 'xfreerdp --version' or 'apt list --installed | grep freerdp' for Debian-based systems. Monitor network traffic for RDP connections with unusually large LoadBalanceInfo fields in Server Redirection PDU messages. Inspect logs for crashes or memory corruption errors in FreeRDP-related applications.

Impact Analysis

This vulnerability can allow a malicious RDP server to crash your FreeRDP client or potentially execute arbitrary code on your system. It requires no user interaction or credentials, making it exploitable remotely. Affected clients include Remmina, GNOME Connections, KRDC, and Apache Guacamole if they use vulnerable libfreerdp versions.

Compliance Impact

This vulnerability could lead to unauthorized code execution or data breaches, violating confidentiality and integrity requirements under GDPR and HIPAA. Organizations using vulnerable FreeRDP versions may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately upgrade FreeRDP to version 3.31.0 or later. If upgrading is not possible, disable RDP connections or restrict access to trusted servers only. Apply network-level mitigations such as firewalls to block malicious RDP traffic. Monitor for unusual activity or crashes in FreeRDP clients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91964. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart