CVE-2026-91959: FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway
FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions before 3.31.0 are affected when they use the RPC gateway transport parser and process a BIND_ACK PDU from an RTS Gateway.
What does an attacker need to do to trigger the vulnerability?
An attacker must cause the affected client to process a malicious BIND_ACK PDU containing a truncated result entry. The published vector indicates network access is sufficient, but user interaction is required.
What is the likely impact of successful exploitation?
The out-of-bounds read can cause the FreeRDP process to abort, resulting in a denial of service. The provided severity vector indicates no confidentiality or integrity impact.
What version resolves the issue?
Upgrade FreeRDP to version 3.31.0 or later. The supplied data identifies versions before 3.31.0 as affected.