CVE-2026-91960: FreeRDP before 3.31.0 Integer Overflow Double Free
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's StreamEnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer wraparound, resulting in a double free that crashes the FreeRDP client during connection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Compensating control
Because a malicious RD Gateway peer can trigger the FreeRDP crash during connection, restrict network access to RD Gateway/WebSocket peers to trusted hosts only (e.g., via firewall/ACL) until FreeRDP 3.31.0 or later is deployed.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions before 3.31.0 are affected when the client connects through a malicious RD Gateway peer. The issue is triggered during the connection when processing a WebSocket Ping frame.
What does an attacker need to do to exploit it?
An attacker needs to act as, or control, an RD Gateway peer that the FreeRDP client connects to. They can send a WebSocket Ping frame with a crafted 64-bit extended payload length; no client privileges are required, but user interaction is required to initiate the connection.
What is the impact of successful exploitation?
Successful exploitation causes an integer wraparound and double free in WinPR's Stream_EnsureRemainingCapacity function, crashing the FreeRDP client. The stated impact is denial of service.
How can this be remediated?
Upgrade FreeRDP to version 3.31.0 or later. The affected versions are those before 3.31.0.