CVE-2026-91959

FreeRDP before version 3.31.0 contains an out-of-bounds read (CWE-125) in the rts_read_result function of its RPC gateway (RD Gateway / RPC-over-HTTP) transport parser. The flaw is triggered when a FreeRDP-based client connects through a malicious or compromised Remote Desktop Gateway that replies with a crafted BIND_ACK PDU containing a truncated result entry, causing the parser to read past the buffer and abort the process. This is a denial-of-service issue only: CVSS 4.0 scores it 7.1 (high) with availability impact (VA:H) but no confidentiality or integrity impact, and exploitation requires user interaction, since the victim must initiate a session to the attacker-controlled gateway. All users of FreeRDP versions prior to 3.31.0, including clients embedded in third-party RDP products, are affected when the gateway transport is used. The vulnerability is not in the CISA KEV catalog, no public proof-of-concept is known, and there is no evidence of exploitation in the wild.

What to do: Upgrade FreeRDP to version 3.31.0 or later, or apply your distribution's patched freerdp/libfreerdp packages if you are on an older branch. Instruct users not to connect through untrusted or unknown Remote Desktop Gateways, since the attack requires the client to initiate a session to a malicious gateway. Investigate any unexplained FreeRDP client aborts during gateway connection setup as possible triggering of this flaw.