CVE-2026-91952: FreeRDP before 3.31.0 Denial of Service via pool_decode_rect
FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode path to loop indefinitely, consuming CPU and preventing normal client operation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch Denial of Service via pool_decode_rect
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running a version before 3.31.0 are exposed when they connect to a malicious RDP server that can deliver crafted AVC444 graphics updates. The issue affects the threaded decode path.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that the vulnerable FreeRDP client connects to. No client privileges are required, but user interaction is required because the client must initiate or accept the connection.
What is the operational impact of successful exploitation?
The crafted update can cause pool_decode_rect to loop indefinitely, consuming CPU and preventing normal operation of the FreeRDP client. The provided information describes a denial of service and does not indicate confidentiality or integrity impact.
How can I remediate the issue?
Upgrade FreeRDP to version 3.31.0 or later. If upgrading cannot happen immediately, avoid connecting affected clients to untrusted RDP servers, particularly where AVC444 graphics updates may be supplied.