CVE-2026-91948

FreeRDP versions before 3.31.0 contain an integer-wrap-driven out-of-bounds write (CWE-191) in the server-side handling of static virtual channels when a channel is registered with CHANNEL_OPTION_SHOW_PROTOCOL. An authenticated remote client triggers the flaw by queuing oversized channel messages, causing a length calculation to underflow and corrupting heap memory, including live pointers, with likely code execution on the RDP server. Any deployment exposing a FreeRDP-based RDP server (Linux RDP servers, gateways, or vendor products embedding the FreeRDP server libraries) is affected, though exploitation requires valid credentials, a vulnerable channel configuration, and high attack complexity (CVSS 4.0: 7.7). No public proof-of-concept or in-the-wild exploitation is known, and the flaw is not on the CISA KEV list.

What to do: Upgrade FreeRDP to 3.31.0 or later, or apply your distribution's patched package, on all systems running FreeRDP-based RDP servers. Audit server configurations for static virtual channels registered with CHANNEL_OPTION_SHOW_PROTOCOL and disable them if not required. Restrict RDP endpoints to VPN or trusted networks and monitor for unusually large or malformed channel traffic from authenticated sessions.