CVE-2026-91955: FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions
FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in multifragment update capability calculations, terminating the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions before 3.31.0 are affected where they accept RDP connections and process client-supplied GCC negotiation data. The attack can be performed remotely over the network without authentication or user interaction.
What does an attacker need to do to trigger the denial of service?
An attacker sends crafted RDP packets during GCC negotiation with DesktopWidth or DesktopHeight set to zero or oversized values. These values can cause a division-by-zero condition or assertion failure while calculating multifragment update capabilities, terminating the server process.
What is the impact if exploitation succeeds?
Successful exploitation crashes the affected server process, resulting in a denial of service. The provided information indicates no confidentiality or integrity impact.