CVE-2026-91953

Executive Summary

CVE-2026-91953 is a heap-based buffer overflow in FreeRDP versions prior to 3.31.0, occurring in the nego_send_negotiation_request() function during RDP connection negotiation. The flaw arises from a failure to validate the length of the LB_LOAD_BALANCE_INFO field before copying it into a fixed 512-byte heap buffer. A malicious RDP server, or a man-in-the-middle positioned between client and server, can send a crafted Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value, overwriting adjacent heap memory with attacker-controlled content. The result is denial of service or heap corruption that is reachable before authentication completes, meaning no valid credentials are required — only user interaction to initiate the connection to a hostile endpoint.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), widely deployed as a client library in Linux distributions, thin clients, and embedded systems, and as a building block in commercial remoting products (e.g., via the libfreerdp library). The vulnerability resides in the connection-negotiation phase, specifically in nego_send_negotiation_request().

The Remote Desktop Protocol supports a Server Redirection mechanism (defined in MS-RDPBCGR), whereby a server can instruct a connecting client to redirect its session to a different server. The redirection PDU carries several fields, including LB_LOAD_BALANCE_INFO — an optional blob of load-balancer metadata. Per the NVD description, FreeRDP prior to 3.31.0 fails to validate the length of this field before writing its contents into a fixed 512-byte buffer allocated on the heap.

Because the destination buffer is of constant size, any LB_LOAD_BALANCE_INFO value whose length exceeds 512 bytes causes an out-of-bounds heap write. The copied bytes are fully attacker-controlled (they come directly from the network PDU), so the classic heap-overflow primitives apply: corruption of adjacent heap chunk metadata, overwriting of neighboring object fields, and — depending on allocator behavior and heap layout — potential for further memory corruption or controlled control-flow influence. The primary and immediately demonstrable impact is a crash (denial of service) or undefined behavior resulting in heap corruption.

Two properties elevate the severity of this finding:

1. Pre-authentication reachability. The description explicitly states the overflow occurs "before authentication completes." The negotiation/redirection PDUs are exchanged during connection setup, so the attacker does not need valid credentials, an account, or even a legitimate RDP server certificate chain that the client validates — a MITM can inject or forge the redirection PDU in transit.
2. Asymmetric trust model. The victim is the client, and the attacker is the server (or the network path). This inverts the common mental model where an RDP server is the defended asset. Here, every FreeRDP client that can be induced to connect to an attacker-controlled or MITM'd endpoint is a potential target.

The assigned CWE is CWE-120 (Classic Buffer Overflow — buffer copy without checking size of input), consistent with the "fails to validate the field length before writing to a fixed 512-byte buffer" description. The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, yielding a base score of 6.5 (Medium). Note the subscores: high attack-vector (Network) and low attack-complexity (AC:L), with no privileges required (PR:N), but requiring user interaction (UI:R) to initiate the connection. There is no confidentiality or integrity impact scored (C:N/I:N), only high availability impact (A:H) — the CNA has scored this as a DoS-oriented overflow, not a demonstrated arbitrary-code-execution primitive. Analysts should nonetheless treat the heap-corruption component as a latent RCE risk pending deeper research, since heap overflows with attacker-controlled content frequently escalate beyond a simple crash.

No public proof-of-concept, exploit code, or Nuclei template is known at the time of writing. Patch confidence is 2/4: a single source (OSV) claims a fix in 3.31.0, but this has not been independently confirmed against the upstream changelog or commit history. No formal vendor advisory or CISA KEV entry exists. The EPSS score of 0.00422 (35.9th percentile) indicates a low but non-zero modeled probability of exploitation in the next 30 days — typical for a newly disclosed, pre-auth library bug with no public PoC.

Exploitation Scenarios

Because no public PoC exists, the attack chain below is described at the vulnerability-class level and is strictly bounded by the NVD description. No specific packet layouts, function names beyond those given, or byte offsets are asserted.

1. Reconnaissance / Target Identification. The attacker identifies a victim who uses a FreeRDP-based client (e.g., an enterprise thin client, a Linux workstation using Remmina or a libfreerdp-linked application, or an embedded appliance). The attacker must control, or be positioned to intercept, the RDP endpoint the victim connects to. This can be achieved by:

• Operating a rogue RDP server (typosquatted hostname, compromised jump host, or a malicious service advertised on a VPN).
• Man-in-the-middle positioning on the network path (ARP spoofing, DNS poisoning, hostile Wi-Fi, or compromised routing) to inject a forged Server Redirection PDU into an otherwise legitimate session. The Shodan dorks above aid an attacker in profiling exposed RDP infrastructure and FreeRDP-linked endpoints, though the victim-side client is the true target for this specific bug.

2. Triggering the Flaw Class (Heap Buffer Overflow). The victim's FreeRDP client initiates negotiation. During the negotiation phase, the malicious/MITM server sends a Server Redirection PDU containing an LB_LOAD_BALANCE_INFO field whose declared length and content exceed 512 bytes. In vulnerable versions (< 3.31.0), nego_send_negotiation_request() writes that field into the fixed 512-byte heap buffer without a bounds check, producing an out-of-bounds write with attacker-controlled bytes. No authentication completes, and no credentials are needed for this step — only the user's action of connecting (UI:R).

3. Payload / Execution Method. The "payload" is the oversized LB_LOAD_BALANCE_INFO content itself. At the vulnerability-class level, an attacker crafts the field so that the overflow reaches and corrupts an adjacent heap object. The simplest reliable outcome is overwriting heap metadata or a neighboring field, causing the allocator or subsequent code to fault — a denial-of-service crash. More advanced exploitation (achievable in principle with careful heap grooming, but not demonstrated here) could aim to overwrite a function pointer or vtable entry to redirect execution. The report does not assert any specific heap layout or gadget, as none is provided in the source data.

4. Post-Exploitation Impact. The guaranteed and scored impact is denial of service: the client process crashes or enters an undefined state, disrupting the user's session and potentially the host application. The secondary, unscored risk is heap corruption that could, with further research, be developed into code execution in the client's security context. Because exploitation is pre-auth and client-side, a successful chain would give an attacker a foothold on the client host — a valuable pivot point inside a trusted network segment — rather than the server.

Impact Assessment

• CVSS base score: 6.5 (Medium), CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H.
• Attack Vector (N): Exploitable over the network; the malicious PDU is delivered remotely.
• Attack Complexity (L): No specialized conditions beyond delivering a crafted PDU; AC is low.
• Privileges Required (N): No authentication or account needed — the bug triggers during negotiation, before login.
• User Interaction (R): The victim must connect to (or be MITM'd toward) the hostile endpoint.
• Scope (U): Impact is confined to the vulnerable client process.
• Confidentiality (N) / Integrity (N): Not scored as impacted; the CNA classifies this as a DoS/availability issue. (Analysts should not assume the absence of these impacts is permanent.)
• Availability (H): The dominant, demonstrated impact — crash and denial of service.
• Blast radius: Every unpatched FreeRDP-based client is affected. Because the library underpins many remoting front-ends and embedded thin clients, the install base is broad, but exploitation requires per-victim interaction and attacker control of the endpoint. This constrains mass exploitation but makes targeted campaigns (spear-phishing, hostile VPN, network MITM) viable.
• EPSS: 0.00422 — low modeled exploitation likelihood; no KEV listing; no known in-the-wild exploitation.

Detection Guidance

Sigma Rule

title: FreeRDP Client Heap Overflow via Server Redirection LB_LOAD_BALANCE_INFO (CVE-2026-91953)
id: 7b9c2f14-2e6a-4f0b-9c1d-9a1e5c3b7d42
status: experimental
description: Detects crashes or abnormal termination of FreeRDP-based client processes,
  consistent with exploitation of the nego_send_negotiation_request heap overflow
  triggered by an oversized LB_LOAD_BALANCE_INFO field in a Server Redirection PDU.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91953
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/remmina'
      - '/freerdp-client'
  selection_crash:
    - CommandLine|contains: 'redirection'
    - CommandLine|contains: 'loadbalance'
  condition: selection_img
falsepositives:
  - Legitimate RDP load-balancer deployments
  - Client crashes unrelated to exploitation
level: low
tags:
  - attack.t1190
  - cve.2026.91953

YARA Rule

rule CVE_2026_91953_FreeRDP_LB_LOAD_BALANCE_INFO_Overflow
{
    meta:
        author = "valtersit.com"
        description = "Detects FreeRDP Server Redirection PDUs carrying oversized LB_LOAD_BALANCE_INFO content (CVE-2026-91953)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91953"
        date = "2026-01-01"
    strings:
        // Static structural anchor: vulnerable FreeRDP build before 3.31.0
        $frdp = "FreeRDP" ascii wide
        $build = /Version: 3\.[0-2][0-9]\.[0-9]/ ascii
        // Negotiation function symbol present in vulnerable binaries
        $sym = "nego_send_negotiation_request" ascii
    condition:
        uint16be(0) == 0x0301 and   // RDP TPKT header version byte 0x03
        $frdp and
        $sym and
        not $build
}

Suricata IDS Rule

alert tcp any 3389 -> any any (msg:"CVE-2026-91953 FreeRDP Server Redirection Oversized LB_LOAD_BALANCE_INFO Heap Overflow"; flow:established,from_server; content:"|03 00|"; depth:2; content:"|RDP|"; offset:4; depth:4; byte_test:2,>,512,0,relative; reference:cve,2026-91953; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91953; classtype:attempted-admin; sid:202691953; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name in ("xfreerdp","wlfreerdp","remmina") and
     process.args : "*redirection*"]
  [process where process.name in ("xfreerdp","wlfreerdp","remmina") and
     event.action == "process-crashed"]

Splunk SPL Query

index=endpoint OR index=linux_syslog
  (process_name IN ("xfreerdp","wlfreerdp","remmina","libfreerdp*"))
  (message="*segmentation fault*" OR message="*SIGSEGV*" OR message="*heap corruption*"
   OR message="*nego_send_negotiation_request*" OR message="*LB_LOAD_BALANCE_INFO*")
| stats count values(message) as messages by host, process_name
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91953,">
  <rule id="202691" level="10">
    <decoded_as>syslog</decoded_as>
    <match>xfreerdp|wlfreerdp|remmina|nego_send_negotiation_request|LB_LOAD_BALANCE_INFO</match>
    <regex>SIGSEGV|heap corruption|segmentation fault</regex>
    <description>CVE-2026-91953: Possible FreeRDP client heap overflow via oversized LB_LOAD_BALANCE_INFO in Server Redirection PDU</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED. A single source (OSV) claims the issue is fixed in FreeRDP 3.31.0. This has not been independently confirmed against the upstream commit history or a vendor security advisory. Treat as provisional and verify before relying on it.

1. Immediate mitigations (apply before or if patching is delayed):

• Restrict RDP client connections to trusted, authenticated endpoints only; avoid connecting FreeRDP-based clients to untrusted or user-supplied hosts.
• Enforce network controls (VPN, TLS-terminating RDP gateway) to reduce man-in-the-middle exposure, since the flaw can be triggered by injected redirection traffic.
• Monitor for anomalous client crashes (see Detection Guidance) as an early indicator of attempted exploitation.
• Where RDP usage is not required, disable/remove FreeRDP-based clients from endpoints to shrink the attack surface.

2. Patch / upgrade steps:

• Upgrade FreeRDP to 3.31.0 or later (per the single-source claim). Verify the fix by checking the upstream FreeRDP release notes/changelog for a corresponding entry before assuming coverage.
• Rebuild or update any applications that statically or dynamically link libfreerdp, including third-party remoting front-ends and embedded appliances.
• Track the NVD entry and OSV record for confirmation of the fix and for any revised affected-version ranges (the current affected-version data is empty/incomplete).

3. Long-term hardening:

• Adopt a dependency-management process that tracks FreeRDP releases across all products bundling the library; embedded clients are frequently missed.
• Implement bounds-checked, length-validated parsers for all PDU fields, and fuzz the negotiation/redirection code paths as part of SDLC.
• Deploy memory-safety mitigations (ASLR, hardened allocators) and application sandboxing for client processes to reduce the impact of heap overflows.

References

• NVD — CVE-2026-91953: https://nvd.nist.gov/vuln/detail/CVE-2026-91953
• OSV — FreeRDP advisory/patch claim (single source): https://osv.dev/ (search CVE-2026-91953)
• FreeRDP upstream project and release notes: https://github.com/FreeRDP/FreeRDP
• FIRST EPSS score page for CVE-2026-91953: https://api.first.org/data/v1/epss?cve=CVE-2026-91953
• CWE-120 (Classic Buffer Overflow): https://cwe.mitre.org/data/definitions/120.html

Threat actor / exploit-in-the-wild evidence: None. CISA KEV status: NO. No public PoC, exploit code, or Nuclei template is known. EPSS 0.00422 (35.9th percentile). The absence of in-the-wild evidence reflects the current state at time of writing and should be re-validated as the CVE ages.