CVE-2026-91960

FreeRDP versions before 3.31.0 contain an integer overflow (CWE-190) in WinPR's Stream_EnsureRemainingCapacity function that can be exploited by a malicious RD Gateway peer during connection establishment. An attacker sends a WebSocket Ping frame with a crafted 64-bit extended payload length, causing integer wraparound that leads to a double free and crashes the FreeRDP client. Successful exploitation results in denial of service only — no code execution, privilege escalation, or data compromise is indicated by the CVSS vector (VC:N/VI:N/VA:H). The attack requires a user to connect to an attacker-controlled or compromised RD Gateway endpoint, limiting opportunistic exploitation. No public proof-of-concept or known in-the-wild exploitation has been reported at time of publication.

What to do: Upgrade FreeRDP to version 3.31.0 or later immediately. If immediate patching is not feasible, restrict or disable RD Gateway WebSocket connections to untrusted hosts and audit gateway endpoint integrity. Monitor FreeRDP client crash logs during gateway handshakes for signs of exploitation attempts.