CVE-2026-91953

FreeRDP versions before 3.31.0 contain a heap buffer overflow (CWE-120) in the nego_send_negotiation_request() function, which copies the LB_LOAD_BALANCE_INFO field from a Server Redirection PDU into a fixed 512-byte buffer without first validating the field's length. The flaw is triggered before authentication completes when a FreeRDP-based client connects to a malicious RDP server, or when a man-in-the-middle intercepts a client's connection, and sends an oversized load-balance-info value containing attacker-controlled bytes. Successful exploitation causes heap corruption and typically results in a crash of the client (denial of service); the CVSS 4.0 score is 7.1 (high) with availability-only impact, and reliable remote code execution has not been demonstrated. All users of FreeRDP-based RDP clients built from the affected library versions are exposed whenever they connect to untrusted or compromised servers. No public proof of concept exists and the flaw is not in the CISA Known Exploited Vulnerabilities catalog, so exploitation is not known to be occurring in the wild.

What to do: Upgrade to FreeRDP 3.31.0 or later, or install your distribution's patched package if you consume FreeRDP through distro repositories or a downstream client (e.g., xfreerdp, Remmina, or vendor products embedding the library). Restrict RDP connections to known, trusted servers and enforce TLS certificate verification, which blocks the man-in-the-middle delivery path (though not the malicious-server path). Review client-side logs for crashes during connection negotiation as an indicator of attempted exploitation.