CVE-2026-91964: FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients running versions 2.0.0 through 3.30.0 are exposed when they connect to a malicious RDP server that sends crafted Server Redirection PDU data.
What does an attacker need to exploit it?
The attacker needs to control, or cause a user to connect to, an RDP server that can send a Server Redirection PDU with an arbitrary-length LoadBalanceInfo field. The supplied severity vector indicates no attacker privileges are required, but user interaction is required.
Are affected clients vulnerable under default behavior?
The issue is triggered while processing Server Redirection PDU messages from the server; the provided data does not identify a separate non-default feature or configuration requirement.
What can be done before patching?
Avoid connecting affected FreeRDP clients to untrusted or attacker-controlled RDP servers, since exploitation depends on malicious server responses. Update to FreeRDP 3.31.0 or later when possible.
How can I determine whether I am affected?
Check the installed FreeRDP version. Versions 2.0.0 through 3.30.0 are affected; versions before 3.31.0 are described as vulnerable.