CVE-2026-91952

FreeRDP versions before 3.31.0 suffer an infinite-loop denial of service (CWE-835) in the pool_decode_rect function when decoding AVC444 metablocks that declare more region rectangles than the preallocated worker array can hold. The flaw is triggered when a client connects to a malicious (or compromised) RDP server that sends crafted AVC444 graphics stream updates, causing the threaded decode path to spin indefinitely. An attacker gains only availability impact: the client's CPU is consumed and normal remote-desktop operation is prevented, with no effect on confidentiality or integrity per the CVSS 4.0 vector (7.1, high; user interaction required). Anyone running a FreeRDP-based RDP client older than 3.31.0 — including distro-packaged clients, graphical front-ends like Remmina, and thin-client firmware embedding FreeRDP — is affected when connecting to an untrusted server. No public proof of concept exists, the CVE is not in CISA's KEV catalog, and no exploitation in the wild is known.

What to do: Upgrade FreeRDP to 3.31.0 or later, or apply your distribution's patched package (e.g., via apt/dnf updates) and push updated firmware for thin clients embedding older FreeRDP. Because exploitation requires connecting to a malicious RDP server, restrict RDP client use to known-trusted hosts and treat unexpected CPU pegging in RDP client processes as a possible indicator. Verify the running version on all client endpoints, especially embedded/thin-client deployments that receive updates slowly.