CVE-2026-91952

Executive Summary

CVE-2026-91952 is an infinite-loop denial-of-service vulnerability in FreeRDP versions prior to 3.31.0, occurring in the pool_decode_rect function during the decoding of AVC444 metablocks that contain more region rectangles than the preallocated worker array can hold. A malicious (attacker-controlled) RDP server can send crafted AVC444 graphics updates that cause the threaded decode path to loop indefinitely, consuming CPU and preventing normal client operation. The primary impacted population is any organization or user connecting a vulnerable FreeRDP-based RDP client to an untrusted, compromised, or attacker-operated RDP endpoint; exploitation requires the victim to initiate a session (CVSS UI:R), and impact is limited to availability (C:N/I:N/A:H).

Technical Analysis

The vulnerability resides in the client-side AVC444 graphics decode path — specifically in pool_decode_rect. FreeRDP consumers that negotiate AVC444 (H.264-based advanced graphics / RemoteFX-class remoting) receive graphics updates encoded as metablocks. Each metablock may describe one or more region rectangles that must be dispatched across a pool of decode workers.

The root cause maps cleanly to CWE-835 (Loop with Unreachable Exit Condition). When an incoming AVC444 metablock declares more region rectangles than the size of the preallocated worker array, the decode routine lacks a bounding/termination condition linking rectangle count to worker capacity. The threaded decode path then loops indefinitely rather than exiting on an out-of-range condition. Because the description explicitly names "threaded decode path," the defective control flow is assumed to be reached through the worker-dispatch logic, but no further function-level detail (e.g., array indexing, macro, or type names) is available in the NVD entry — those specifics are not stated and must not be assumed.

Attack surface and preconditions:

• Vector type: Network-adjacent to the RDP session (AV:N).
• Privilege requirement: None on the client (PR:N).
• User interaction: Required — the client must connect to the malicious server (UI:R).
• Scope: Unchanged (S:U) — the effect is confined to the vulnerable client process/host.
• Confidentiality / Integrity: None (C:N/I:N) — the flaw does not exfiltrate or corrupt data.

CVSS 3.1 rates this 6.5 (Medium). The temporal/exploitability context is low: EPSS is 0.00346 (approximately the 28th percentile), no CISA KEV listing, and no public PoC, exploit code, or Nuclei template exists as of this writing. The realistic threat model is therefore targeted or opportunistic abuse rather than mass exploitation.

Exploitation Scenarios

Because no public PoC exists, the following attack chain is inferred strictly from the vulnerability class (CWE-835) and the NVD description. No specific code patterns, function names beyond those named in the description, or hypothetical endpoints are invented here.

1) Reconnaissance / target identification. The adversary must control, compromise, or MITM an RDP endpoint that a victim will connect to using a FreeRDP-based client older than 3.31.0. Relevant reconnaissance involves identifying clients that negotiate AVC444 graphics (H.264 codec support / advanced graphics pipeline) and are running an affected build. Adversary-controlled RDP infrastructure and look-alike jump hosts are the simplest delivery vehicles; an on-path position between client and server is an alternative.

2) Trigger of the specific flaw class. During an established session, after AVC444 capability negotiation, the malicious server sends a crafted AVC444 graphics update. The metablock in that update declares more region rectangles than the preallocated worker array size. On receipt, the client's threaded decode path enters the unbounded loop in pool_decode_rect and never reaches a termination condition.

3) Payload / execution method (vulnerability-class level). The "payload" is a malformed AVC444 graphics update stream delivered over the normal RDP channel — no code execution, memory corruption, or privilege primitive is required. The malicious server does not need to exploit a parser memory-safety bug; it simply supplies input that violates the rectangle-count/worker-capacity invariant.

4) Post-exploitation impact. The vulnerable client's decode thread(s) spin indefinitely, saturating CPU and preventing normal client operation. Depending on implementation and host resources, the affected client process becomes unresponsive and may need to be forcibly terminated, killing the session. Repeated connections (or repeated crafted updates on a persistent session) produce a sustained client-side denial of service. The server side is unaffected, and the attacker gains no foothold on the client beyond the resource exhaustion.

Impact Assessment

• Direct impact: Availability loss on the FreeRDP client host — persistent CPU consumption by the decode thread(s) and loss of normal RDP client function. Denial of the remote-desktop session is the practical effect; degradation may extend to the host if CPU is pinned.
• CVSS 3.1 subscores: AV:N (network-reachable through the RDP session), AC:L (no special conditions per the vector), PR:N (no client-side privilege needed), UI:R (victim must connect), S:U (no scope change), C:N/I:N (no data exposure or modification), A:H (High availability impact) — yielding 6.5.
• Blast radius: Scoped to endpoints running a FreeRDP-based client below 3.31.0 that negotiate AVC444. This includes thin-client deployments, Linux/BSD/macOS RDP client users, and applications embedding FreeRDP as a library. Because servers are unaffected, the blast radius is client-side and per-session rather than fleet-wide.
• Threat context: EPSS 0.00346 (~28th percentile) and no KEV/PoC activity indicate low near-term likelihood of widespread exploitation. The vulnerability is most relevant where users routinely connect to external or untrusted RDP endpoints — e.g., BYOD remote-access scenarios, third-party support sessions, and contractor-managed jump hosts.
• Secondary effects: Lost sessions can interrupt remote administration, support operations, and thin-client workflows; at scale (many client connections to one malicious server) this can become a coordinated client-fleet DoS.

Detection Guidance

Sigma Rule

title: Potential FreeRDP AVC444 Infinite-Loop DoS (CVE-2026-91952) - Client CPU Exhaustion
id: 6f1c8a2e-4b7d-4e9a-9d3c-91952freerdp
status: experimental
description: Detects FreeRDP client processes pinned at sustained high CPU after connecting to an RDP server, consistent with the pool_decode_rect infinite loop triggered by crafted AVC444 metablocks (CVE-2026-91952).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91952
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection_process:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/sdl-freerdp'
  condition: selection_process
level: low
falsepositives:
  - Legitimate high-load RDP sessions with heavy graphics workloads
  - Normal FreeRDP client startup (pair with CPU thresholds via an EDR/telemetry source)

Note: FreeRDP client process names are shown generically (xfreerdp / wlfreerdp / sdl-freerdp). The precondition — sustained abnormal CPU consumption after session establishment — should be correlated with host CPU telemetry, since process-creation logs alone cannot confirm the loop.

YARA Rule

rule CVE_2026_91952_FreeRDP_AVC444_Metablock
{
    meta:
        author = "valtersit.com"
        description = "Heuristic detection of AVC444 graphics update payloads carrying an oversized region-rectangle count consistent with CVE-2026-91952 FreeRDP pool_decode_rect infinite loop"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91952"
        date = "2026-01-01"
        cve = "CVE-2026-91952"

    strings:
        $avc444 = "AVC444"

    condition:
        // Heuristic: packet/capture artifact containing the AVC444 codec marker.
        // Full validation requires RDP graphics-layer parsing of metablock region-rectangle counts.
        $avc444
}

Suricata IDS Rule

alert tcp any any -> any 3389 (msg:"CVE-2026-91952 FreeRDP AVC444 Metablock Oversized Region-Rectangle Count DoS Attempt"; flow:established,to_client; content:"AVC444"; nocase; classtype:attempted-dos; reference:cve,2026-91952; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91952; sid:9195201; rev:1;)

Note: RDP uses TLS for most modern connections; this signature targets plaintext RDP or post-decryption inspection. The AVC444 content match is a coarse indicator and should be tuned against a capture baseline. A precise rule requires RDP graphics-pipeline reassembly.

Elastic Detection

process where event.type == "start" and
  process.name in ("xfreerdp", "wlfreerdp", "sdl-freerdp")

Correlate with host metrics (system.process.cpu.total.pct pinned near 1.0 on the FreeRDP process for an abnormal duration) to confirm loop behavior, rather than relying on process start events alone.

Splunk SPL Query

index=main sourcetype=WinEventLog:Security OR index=main sourcetype=syslog
| eval freerdp_proc=if(match(lower(_raw), "(xfreerdp|wlfreerdp|sdl-freerdp|freerdp)"), 1, 0)
| where freerdp_proc=1
| stats count earliest(_time) as first_seen latest(_time) as last_seen by host, process_name, process_id
| where count > 1
| table host, process_name, process_id, first_seen, last_seen, count

Tune to your endpoint telemetry. The signal of interest is sustained repeated FreeRDP session activity accompanied by host CPU pressure, not a single session start.

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91952,">
  <rule id="100952" level="10">
    <decoded_as>json</decoded_as>
    <field name="process.name">xfreerdp|wlfreerdp|sdl-freerdp</field>
    <description>CVE-2026-91952: FreeRDP client process detected - verify for AVC444 decode infinite-loop (pool_decode_rect) DoS against version &lt; 3.31.0</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

This is an advisory-level rule keyed on FreeRDP process telemetry. A precise detection requires pairing it with CPU/persistence anomalies on the host.

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix: OSV and Debian).

1. Immediate mitigations

   • Upgrade all FreeRDP-based clients to 3.31.0 or later; affected range is < 3.31.0.
   • Where immediate upgrade is not possible, restrict client connections to trusted RDP endpoints and disallow user-initiated connections to untrusted/external RDP servers (the attack requires connecting to an attacker-controlled server).
   • If AVC444 / advanced graphics negotiation can be administratively disabled in your client deployment/configuration without loss of required functionality, treat that as a compensating control to reduce exposure until patching is complete (validate against your specific deployment before relying on it).
   • Deploy host CPU-monitoring/EDR alerting to detect FreeRDP processes pinned at high CPU, so affected sessions can be killed promptly.
   • The upstream data provided no CVE-specific workaround text ("Workarounds: N/A"); the version upgrade is the authoritative remediation.

2. Patch / upgrade steps

   • Update FreeRDP-based clients and any applications embedding FreeRDP as a library to 3.31.0+ via your distribution package manager (Debian-sourced fix available) or upstream source.
   • Inventory embedded FreeRDP usage (thin clients, remote-support appliances, custom applications) — these are frequently missed by endpoint patching workflows.
   • Verify post-patch that AVC444 sessions function normally and that the version reported by the client is 3.31.0 or greater.

3. Long-term hardening

   • Maintain a software bill of materials (SBOM) that flags embedded FreeRDP versions, since the fix confidence rests on two independent distribution sources (OSV, Debian) rather than a single vendor bulletin.
   • Baseline and monitor RDP client CPU behavior per session; anomalous sustained consumption should trigger automatic session termination.
   • Apply least-privilege and network-egress controls to limit which RDP endpoints client hosts may reach, reducing the reachable attack surface for server-initiated DoS.
   • Track FreeRDP advisories and the CVE record for any future workaround updates, as none were supplied with this dataset.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91952
• CWE-835 — Loop with Unreachable Exit Condition: https://cwe.mitre.org/data/definitions/835.html
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• OSV (fix confirmation source): https://osv.dev
• Debian Security Tracker (fix confirmation source): https://security-tracker.debian.org

Threat actor / exploit-in-the-wild status: None observed. No CISA KEV listing, no public PoC, no exploit code, and no Nuclei template were identified for CVE-2026-91952. Exploitation likelihood is low based on EPSS 0.00346 (~28th percentile). The principal defensive objective is client-fleet upgrade to FreeRDP 3.31.0 and monitoring for sustained FreeRDP client CPU exhaustion.