CVE-2026-91964 FreeRDP CVE debrief

Who should care

Defenders responsible for RDP servers and clients, particularly those using FreeRDP, should assess exposure and prioritize updates. This includes administrators managing RDP infrastructure, security teams evaluating vulnerability impact, and IT personnel responsible for applying patches and maintaining system security.

Why it matters

CVE-2026-91964 is a high-severity vulnerability in FreeRDP that can lead to client crashes or potential code execution. Defenders responsible for RDP servers and clients, particularly those using FreeRDP, should assess exposure and prioritize updates.

• Potential code execution when chained with memory disclosure
• Client crashes due to buffer overflow
• Verification of RDP server and client configurations required
• Remediation priority for FreeRDP versions before 3.31.0

Technical summary

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Defensive priority

High

Recommended defensive actions

• Update FreeRDP to version 3.31.0 or later
• Restrict access to RDP servers
• Monitor for suspicious RDP activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry describe a heap-based buffer overflow in FreeRDP versions before 3.31.0. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.