CVE-2026-91964

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow (CWE-122) in the nego_send_negotiation_request function, triggered when the client processes a Server Redirection PDU carrying an attacker-controlled LoadBalanceInfo field. A malicious RDP server can supply an arbitrary-length field that is written into a fixed 512-byte buffer without bounds validation, corrupting heap memory. Successful exploitation crashes the client and may allow code execution when chained with a separate memory-disclosure primitive, so an attacker who convinces a user to connect to a hostile RDP server gains high impact on confidentiality, integrity, and availability (CVSS 4.0: 8.7, user interaction required). Anyone running FreeRDP-based RDP clients older than 3.31.0, including downstream products that bundle the library, is affected. No public proof of concept is known, the flaw is not on the CISA KEV list, and there is no evidence of exploitation in the wild.

What to do: Upgrade FreeRDP to version 3.31.0 or later as soon as it is available from your distribution or vendor, and check whether bundled products (Remmina, Apache Guacamole, thin-client images, custom FreeRDP integrations) have shipped patched builds. In the interim, restrict RDP connections to known, trusted servers and gateways, since exploitation requires a user to connect to an attacker-controlled server. Watch for crashes in RDP sessions following redirection prompts as a possible indicator, and track vendor advisories for backported fixes to older branches.