CVE-2026-91950: FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdrdumppacket function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker operating a malicious RDP server can exploit it against a FreeRDP client that connects to that server. The vector is network-based, but exploitation requires a user to initiate the RDP connection.
What is the impact on an affected client?
A crafted RDPDR packet can cause out-of-bounds reads, resulting in a client crash. Data from the heap may also be disclosed through logs.
Which versions need remediation?
FreeRDP versions before 3.31.0 are affected. Updating to 3.31.0 or later addresses the affected version range.
What can be done before updating?
Avoid connecting affected FreeRDP clients to untrusted or unknown RDP servers. Limit RDP connections to servers under administrative control, since the malicious packet is sent by the server.