CVE-2026-91958: FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index
FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xfdetectmonitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in xfreerdp.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Operational
Update FreeRDP instances affected by FreeRDP versions 3.11.0 through 3.30.0 so that RDP connection files opened in xfreerdp no longer trigger out-of-bounds heap read/write via an out-of-range selectedmonitors value.
Event History
Frequently Asked Questions
What user action is required for exploitation?
An attacker must persuade a user to open a crafted RDP connection file in xfreerdp. The malicious file uses an out-of-range selectedmonitors value.
Are default FreeRDP installations affected?
The issue is triggered while parsing RDP connection files in xfreerdp. The provided data does not identify any additional configuration prerequisite beyond opening a crafted file.
Which versions should be remediated?
FreeRDP versions 3.11.0 through 3.30.0 are affected. Versions before 3.31.0 are described as failing to validate the relevant MonitorIds values.
What can happen if exploitation succeeds?
Opening the crafted file can cause out-of-bounds heap read and write operations in xf_detect_monitors. The listed impact includes low confidentiality and integrity impact and high availability impact.