CVE-2026-91950

FreeRDP before 3.31.0 contains an out-of-bounds read (CWE-125) in the rdpdr_dump_packet function, caused by 32-bit unsigned integer wraparound in the buffer bounds validation. A malicious RDP server exploits this by sending a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0, which wraps the length check and causes memory reads past the end of the packet buffer. The attacker gains a denial of service (client crash, Availability impact rated High per CVSS 4.0 score 7.1) and potential heap memory disclosure into client logs, since the dump routine prints packet contents. This is a reversed attack direction: the victim is any FreeRDP-based client user who connects to an attacker-controlled or compromised RDP server, which is why the CVSS vector includes user interaction. No public proof of concept is known and the flaw is not in the CISA KEV catalog, so exploitation status is none known.

What to do: Upgrade FreeRDP to 3.31.0 or later, or apply your distribution's patched package as soon as it is available. As mitigations, restrict client connections to trusted, known RDP servers and disable verbose/debug logging (the RDPDR packet dump) so any residual out-of-bounds data is not written to logs. Organizations should inventory embedded products (thin clients, remote-access tools) that bundle FreeRDP and verify they are not shipping a version older than 3.31.0.