Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-91964

FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

Default version status: unaffected

  • 2.0.0 to < 3.0.0affected
  • 3.0.0 to < 3.31.0affected
  • 3.31.0unaffected

FreeRDP FreeRDP

Default version status: unaffected

  • 0 to < 3.31.0affected
  • 3.31.0unaffected

References