CVE-2026-91950

Executive Summary

CVE-2026-91950 is an out-of-bounds read (CWE-125) in FreeRDP versions before 3.31.0, located in the rdpdr_dump_packet function. The flaw is caused by 32-bit unsigned integer wraparound during buffer bounds validation, allowing a malicious or compromised RDP server to send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0, bypassing the length check and causing memory reads beyond the packet buffer. Successful triggering results in client crashes (denial of service) and potential heap memory disclosure into client-side logs. The vulnerability requires user interaction (a victim must connect to the attacker-controlled or malicious RDP server) and does not permit direct code execution as described.

FreeRDP is a widely used open-source Remote Desktop Protocol client library deployed on Linux, macOS, Windows, Android, and iOS endpoints, and embedded in thin clients, virtual desktop infrastructure (VDI) agents, and administrative jump hosts. Because the vulnerable code path sits in the RDPDR (device redirection) channel, any FreeRDP-based client that connects to an untrusted RDP endpoint — including RDP servers operated by third parties, red-team/blue-team testing infrastructure, or compromised legitimate servers — is exposed to the crash and log-disclosure condition.

Technical Analysis

FreeRDP implements the RDPDR virtual channel used for device redirection (drive, printer, port, smart card redirection) between RDP client and server. The rdpdr_dump_packet function is a diagnostic/logging routine that serializes and prints RDPDR packet contents. During this dumping logic, the function parses a computerNameLen field — a length value carried inside the RDPDR packet that describes the size of a computer-name string — and uses it to validate and read the corresponding data region from the packet buffer.

The defect is an off-by-wraparound in bounds validation: computerNameLen is treated as a 32-bit unsigned integer, and the validation arithmetic overflows when the value is set to 0xFFFFFFF0 (4,294,967,280). Adding this length to the current buffer offset wraps around the 32-bit address/length space, causing the computed end-of-buffer value to appear smaller than the offset. The bounds check therefore passes even though computerNameLen vastly exceeds the actual remaining packet size. The subsequent read operation then walks past the end of the allocated packet buffer, producing an out-of-bounds read.

Impact mechanics:

1. Availability (High): Reads past the packet buffer can hit unmapped pages, causing an access violation and client crash. Because the malformed packet is delivered by the server, the client has no opportunity to reject it before the dump routine is invoked, resulting in a denial-of-service against the RDP session (and potentially the client process itself).
2. Confidentiality (None per CVSS): The CVSS vector assigns C:N, reflecting that the disclosed data (heap contents written into client logs) is not directly returned to the attacker. However, the NVD description explicitly notes "heap disclosure in logs" — meaning sensitive process memory may be persisted to a log file readable by local users or log-aggregation pipelines. This is a secondary, local-only exposure path that the CVSS base score does not fully capture because the attacker does not directly receive the leaked bytes.

The attack surface is the RDPDR virtual channel data stream. The attacker does not need authentication (PR:N) because the malicious party is the server and the victim initiates the connection (user interaction, UI:R — the user must connect to the hostile endpoint). AC:L reflects that no special conditions beyond a crafted packet are required once the channel is negotiated. Because RDPDR is negotiated during session establishment, the malicious server controls channel parameters and can arrange to trigger the dump path.

No public proof-of-concept exists, no Nuclei template is available, and no exploit code has been published. The technical description above is derived strictly from the NVD text; no additional function names, parameters, or code paths beyond rdpdr_dump_packet and computerNameLen should be assumed.

Exploitation Scenarios

No public PoC is available. The chain below is inferred from the vulnerability class (out-of-bounds read via integer wraparound in packet parsing) and the NVD description. No specific implementation details beyond those stated are asserted.

1. Reconnaissance / Target Identification. An adversary positions an RDP server (or compromises an existing one) and induces a user to connect with a FreeRDP-based client. Discovery of FreeRDP clients on a network can be approximated via RDP service exposure (port:3389) and client fingerprinting; however, the vulnerable component is the client, so the practical attack is a server-side lure — phishing a user into opening an .rdp connection file, redirecting via DNS, or leveraging an existing trusted-but-compromised RDP server.

2. Triggering the Flaw (vulnerability-class level). During RDPDR channel negotiation, the malicious server crafts an RDPDR packet containing the computerNameLen field set to 0xFFFFFFF0. When the client's rdpdr_dump_packet routine computes the buffer bound, the 32-bit unsigned addition wraps, the check passes, and a read is issued past the end of the packet buffer.

3. Payload / Execution Method (vulnerability-class level). No code injection or ROP chain is required to trigger the bug; the malformed length field is the payload. Delivery is via the RDPDR virtual-channel data stream over an established RDP session. The client processes the packet as part of normal dump/log handling.

4. Post-Exploitation Impact. The out-of-bounds read causes an assertion failure, heap fault, or memory access violation, terminating the client session or process (denial of service). In cases where the read does not immediately fault, heap bytes adjacent to the packet buffer may be copied into client-side log output ("heap disclosure in logs"). No evidence indicates remote code execution, credential theft, or lateral movement from this CVE alone.

Impact Assessment

CVSS: 6.5 — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Medium).

• AV:N — attack is delivered over the network via the RDP session.
• AC:L — no special conditions beyond a crafted RDPDR packet are needed.
• PR:N — the attacker is the server; no client-side credentials are required.
• UI:R — a victim user must initiate a connection to the malicious/compromised RDP server.
• S:U — impact is confined to the client process scope.
• C:N — the attacker does not directly receive leaked data; disclosure is to local logs only.
• I:N — no integrity impact.
• A:H — a successful trigger can crash the client, denying the RDP session.

Blast radius. Any host running a FreeRDP-based client below 3.31.0 that can be induced to connect to an attacker-influenced RDP endpoint. This includes Linux/macOS workstations using xfreerdp/wlfreerdp, thin clients, helpdesk and admin jump hosts, and applications embedding the FreeRDP library. Repeated triggering enables persistent disruption of remote-administration workflows. The log-disclosure path raises a confidentiality concern for environments where client logs are centrally aggregated and broadly readable, since heap fragments — which may include adjacent buffer contents — could be persisted and indexed.

Business impact. For most enterprises the primary effect is loss of availability of remote-access sessions and potential noise/false-alarm load on endpoint-monitoring pipelines from repeated client crashes. No CISA KEV listing indicates the vulnerability is not observed as exploited in the wild as of this writing. EPSS is 0.00451 (38.3rd percentile), indicating a low near-term exploitation probability consistent with the absence of a public PoC.

Detection Guidance

Sigma Rule

title: FreeRDP RDPDR Out-of-Bounds Read Attempt (CVE-2026-91950)
id: 8f2b1c44-3d7a-4e21-9c6f-rdprdrds0b1
status: experimental
description: Detects FreeRDP client crashes / errors consistent with a crafted RDPDR
  packet carrying an oversized computerNameLen value (0xFFFFFFF0) triggering an
  out-of-bounds read in rdpdr_dump_packet.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91950
author: Threat Intelligence (valtersit.com)
date: 2026/01/01
logsource:
  product: linux
  service: syslog
detection:
  selection_proc:
    process.name|contains:
      - 'xfreerdp'
      - 'wlfreerdp'
      - 'sdl-freerdp'
  selection_fault:
    message|contains:
      - 'rdpdr_dump_packet'
      - 'computerNameLen'
      - 'out-of-bounds'
      - 'buffer overflow'
      - 'Segmentation fault'
      - 'heap'
  condition: selection_proc and selection_fault
falsepositives:
  - Legitimate FreeRDP client crashes unrelated to RDPDR parsing
  - Debug/log builds emitting verbose RDPDR dumps
level: medium
tags:
  - attack.t1203
  - cve.2026.91950

YARA Rule

rule CVE_2026_91950_FreeRDP_RDPDR_OOB
{
    meta:
        description = "Detects FreeRDP binaries/build metadata referencing the rdpdr_dump_packet RDPDR dump path associated with CVE-2026-91950 (informational/versioning)"
        author = "Threat Intelligence (valtersit.com)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91950"
        date = "2026-01-01"
        cve = "CVE-2026-91950"

    strings:
        $func   = "rdpdr_dump_packet" ascii
        $field  = "computerNameLen" ascii
        $rdpdr  = "rdpdr" ascii nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and $rdpdr and ($func or $field)
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET 3389 -> $HOME_NET any (msg:"CVE-2026-91950 FreeRDP RDPDR crafted computerNameLen OOB read attempt"; flow:established,from_server; content:"|00 00 00 00|"; byte_test:4,>,0xFFFFF000,0,relative; classtype:attempted-dos; reference:cve,2026-91950; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91950; sid:202691950; rev:1;)

Elastic Detection

process where process.name in ("xfreerdp", "wlfreerdp", "sdl-freerdp") and
  (message like "*rdpdr_dump_packet*" or
   message like "*computerNameLen*" or
   message like "*out-of-bounds*" or
   message like "*Segmentation fault*")

Splunk SPL Query

index=main (sourcetype=syslog OR sourcetype=linux_secure OR sourcetype=endpoint)
(process_name="xfreerdp" OR process_name="wlfreerdp" OR process_name="sdl-freerdp")
(message="*rdpdr_dump_packet*" OR message="*computerNameLen*" OR message="*out-of-bounds*" OR message="*Segmentation fault*" OR message="*heap*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, message
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91950,">
  <rule id="100950" level="10">
    <decoded_as>syslog</decoded_as>
    <match>rdpdr_dump_packet|computerNameLen</match>
    <description>CVE-2026-91950: FreeRDP RDPDR out-of-bounds read indicator (rdpdr_dump_packet/computerNameLen)</description>
    <mitre>
      <id>T1203</id>
    </mitre>
    <group>attack,availability,</group>
  </rule>
  <rule id="100951" level="8">
    <decoded_as>syslog</decoded_as>
    <match>xfreerdp|wlfreerdp|sdl-freerdp</match>
    <regex>Segmentation fault|out-of-bounds|heap</regex>
    <description>CVE-2026-91950: FreeRDP client crash consistent with crafted RDPDR packet</description>
    <group>attack,availability,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch via OSV; not independently confirmed). Treat the fix as probable but verify against the upstream FreeRDP repository before relying on it alone.

1. Immediate mitigations (while patching):

   • Avoid connecting FreeRDP-based clients to untrusted, third-party, or unverified RDP servers. Treat unsolicited .rdp files and DNS redirection to unexpected endpoints as hostile.
   • Disable verbose RDPDR packet dumping in client logging where configurable, reducing the likelihood (and sensitivity) of log-based heap disclosure.
   • Apply host-based controls that constrain which destinations clients may reach (egress filtering to approved RDP endpoints), limiting the attacker's ability to lure a client to a controlled server.
   • Centralize and tightly restrict read access to client logs to reduce the confidentiality exposure from the "heap disclosure in logs" path.

2. Patch / upgrade steps:

   • Upgrade FreeRDP to 3.31.0 or later (claimed fix). Confirm the version string with xfreerdp --version after upgrade.
   • Verify the patch against upstream FreeRDP release notes/changelog and the OSV record before considering the issue closed, given the single-source nature of the claim.
   • Rebuild any applications that statically link the FreeRDP library, since linked binaries will not pick up a system-library upgrade.
   • For package-managed installs (e.g., distro packages), track the vendor's fixed package version and apply via the standard update channel.

3. Long-term hardening:

   • Adopt a software bill of materials (SBOM) to identify FreeRDP and other RDP client libraries embedded in thin clients, VDI agents, and custom tooling.
   • Monitor upstream FreeRDP advisories and OSV for independent confirmation of the fix.
   • Fuzz RDPDR and other virtual-channel parsers as part of routine client validation, given the recurring pattern of length-field parsing weaknesses.
   • Enforce least-privilege and log-access segmentation so that any heap fragments written to logs remain contained.

References

1. NVD — CVE-2026-91950: https://nvd.nist.gov/vuln/detail/CVE-2026-91950
2. OSV — advisory record (single-source patch claim for FreeRDP 3.31.0): https://osv.dev/vulnerability/CVE-2026-91950
3. FreeRDP Project — upstream repository and release notes (verify 3.31.0 changelog): https://github.com/FreeRDP/FreeRDP
4. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
5. CISA Known Exploited Vulnerabilities Catalog (checked — CVE-2026-91950 NOT listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor / exploit-in-the-wild note: No public proof-of-concept, no exploit code, no Nuclei template, and no CISA KEV listing are associated with CVE-2026-91950 at the time of writing. EPSS is 0.00451 (38.3rd percentile), consistent with low observed exploitation likelihood. All exploitation details in this report are inferred from the stated vulnerability class and NVD description, not from observed campaigns.