CVE-2026-91955

FreeRDP before 3.31.0 does not validate the client-supplied DesktopWidth and DesktopHeight values exchanged during GCC negotiation in the RDP handshake. A remote, unauthenticated attacker can send crafted RDP packets with zero or oversized dimensions, triggering division-by-zero errors or assertion failures in multifragment update capability calculations that terminate the server process. The impact is limited to availability — a complete crash of the FreeRDP-based server — with no effect on confidentiality or integrity. Any deployment running a FreeRDP server component older than 3.31.0 and reachable over the network is affected, particularly RDP endpoints exposed to untrusted networks. No public proof of concept is known, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade FreeRDP to version 3.31.0 or later as soon as possible. Until patched, restrict access to RDP listening ports (TCP/UDP 3389) so that only trusted VPN or firewall-authorized clients can connect. Review server logs for assertion failures or division-by-zero crashes in the multifragment update code path, which would indicate attempted exploitation.