CVE-2026-91953: FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest() that fails to validate the LBLOADBALANCEINFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LBLOADBALANCEINFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Compensating control
Until upgraded, mitigate exposure by preventing untrusted/unknown RDP endpoints or man-in-the-middle scenarios from initiating FreeRDP connections (e.g., restrict outbound RDP connectivity to trusted servers via network controls).
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running a version before 3.31.0 are exposed when they connect to a malicious RDP server or when an attacker can act as a man-in-the-middle for the RDP connection.
What must an attacker do to trigger the vulnerability?
The attacker must deliver a Server Redirection PDU containing an oversized LB_LOAD_BALANCE_INFO value. Exploitation occurs before authentication completes and requires the user to initiate or proceed with the affected RDP connection.
How can I determine whether a deployment is affected?
Check the installed FreeRDP version. Versions earlier than 3.31.0 are affected; version 3.31.0 or later is not identified as affected by the provided information.
What can be done if upgrading is not immediately possible?
Avoid connecting affected clients to untrusted RDP servers and reduce opportunities for man-in-the-middle interception of RDP traffic. The provided information does not describe a configuration-level workaround.