CVE-2026-91955

Executive Summary

CVE-2026-91955 is a denial-of-service vulnerability in FreeRDP releases prior to 3.31.0. The defect resides in GCC capability negotiation, where the server fails to validate client-supplied DesktopWidth and DesktopHeight values. A remote, unauthenticated attacker can send crafted RDP negotiation packets containing zero or oversized dimensions to trigger division-by-zero faults or assertion failures during multifragment update capability calculations, terminating the server process. Any deployment exposing a FreeRDP-based RDP server to an untrusted network is affected; impact is limited to availability (CVSS 7.5, A:H) with no confidentiality or integrity loss.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol, used both as a client and as a server component in numerous products (remote access gateways, thin-client infrastructure, VDI platforms, and embedded appliances). The vulnerability class is CWE-369 (Divide By Zero), with secondary failure via assertion abort.

The attack surface is the GCC (Generic Conference Control) negotiation phase of RDP connection establishment. Before a session is fully established, the client transmits its capability set — including requested desktop geometry expressed as DesktopWidth and DesktopHeight — to the server. Per the NVD description, FreeRDP versions before 3.31.0 fail to validate these client-supplied values.

The critical failure mode is arithmetic and assertion-based:

1. Zero dimensions: A client-supplied width or height of 0 flows into multifragment update capability calculations. Any computation that divides a buffer size, tile count, or fragment count by a dimension produces a division-by-zero condition. In C/C++ this is undefined behavior and typically raises SIGFPE on x86, terminating the process.
2. Oversized dimensions: Extremely large values propagate into the same calculations and can violate internal invariants, triggering assertion failures (abort) in debug or invariant-checking builds, or producing oversized allocation/fragment counts that crash the process.

Both paths result in server process termination. The vulnerability is reachable during GCC negotiation — i.e., early in the connection lifecycle, before authentication and before any user-level session state exists. This is significant: no credentials, no valid user account, and no completed handshake are required, consistent with the CVSS vector (AV:N/AC:L/PR:N/UI:N) and the "remote attackers" phrasing in the NVD description.

No further code-level detail (specific function names, symbol names, or call sites) is provided in the NVD description or CNA title. The precise internal routine that performs the multifragment update capability calculation is not named in the source data, and is therefore not asserted here.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred strictly from the vulnerability class and the NVD description; no specific function names, packet field offsets, or API endpoints are invented.

1. Reconnaissance / target identification. An attacker identifies a reachable RDP endpoint backed by FreeRDP < 3.31.0. This can be done by scanning for RDP services (commonly TCP/3389, though FreeRDP-based servers may listen on alternate ports), fingerprinting the RDP negotiation banner, or targeting known deployments (VDI gateways, thin clients, embedded remote-access appliances) whose firmware ships a vulnerable FreeRDP library.

2. Triggering the flaw class. The attacker initiates an RDP connection and proceeds through the GCC negotiation phase. Instead of sending a normal, well-formed capability set with sane desktop geometry, the attacker supplies a crafted capability exchange in which DesktopWidth and/or DesktopHeight are set to zero (or to grossly oversized values). This is the client-controlled input surface the server fails to validate.

3. Payload / execution method (vulnerability-class level). The malformed dimensions are consumed by the server's multifragment update capability calculations. With a zero dimension, a division by that dimension yields a divide-by-zero fault (SIGFPE / analogous fault), immediately terminating the process. With oversized dimensions, the resulting arithmetic and internal invariants are violated, leading to an assertion failure and abort. No memory corruption, code execution, or privilege escalation is described. The entire effect is availability loss.

4. Post-exploitation impact. The server process terminates. Depending on deployment, the service may restart automatically (supervisor/systemd) — in which case the attacker can loop the crafted packet to sustain a repeated-crash DoS — or remain down, causing a full outage. Because no authentication is required, the attacker does not need any account or credential; the technique is trivially repeatable and scriptable.

Impact Assessment

CVSS 3.1 base score 7.5 (High). Subscore breakdown as reflected in the vector:

• Confidentiality: None (C:N) — no data disclosure is described.
• Integrity: None (I:N) — no data modification is described.
• Availability: High (A:H) — the server process terminates, fully disrupting the remote desktop service.

Attack prerequisites are minimal: network reachability (AV:N), low complexity (AC:L), no privileges (PR:N), and no user interaction (UI:N). This makes the vulnerability attractive for unsophisticated denial-of-service attacks, including botnet-driven flooding and hacktivist disruption.

Business impact: Any organization running an affected FreeRDP-based RDP server externally is at risk of service outage. Blast radius is scoped to the single server process on each targeted host (CVSS scope is Unchanged), but because a single crafted packet is enough to kill it, even low-volume attacks can produce sustained outages through automated repetition. For thin-client and VDI backends, terminating the server process disrupts every active session on that host. For embedded remote-access appliances, recovery may require manual intervention if no process supervisor is present.

EPSS is not yet scored by FIRST.org, and CVE-2026-91955 is not listed in CISA KEV. No exploit-in-the-wild evidence, threat actor attribution, or campaign data is available.

Detection Guidance

Sigma Rule

title: FreeRDP Server Process Crash via Malformed GCC Desktop Dimensions (CVE-2026-91955)
id: 6c9e3f2a-1b7d-4e58-9a44-0b3c7d9e1f20
status: experimental
description: Detects abnormal termination of a FreeRDP-based server process consistent with a divide-by-zero or assertion failure triggered by crafted client-supplied DesktopWidth/DesktopHeight values during GCC negotiation.
author: valtersit.com
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91955
logsource:
  product: linux
  service: auditd
detection:
  selection_signal:
    - type: 'SIGFPE'
    - type: 'SIGABRT'
  selection_process:
    Image|endswith:
      - '/freerdp'
      - '/freerdp-server'
      - '/xfreerdp'
      - '/wfreerdp'
    ProcessName|contains: 'freerdp'
  condition: selection_signal and selection_process
fields:
  - Image
  - ProcessName
  - type
  - exit_code
falsepositives:
  - Legitimate FreeRDP restarts driven by unrelated assertion faults
  - Debug builds with assertion checking enabled
level: high
tags:
  - attack.t1190
  - cve.2026.91955
  - cwe.369

YARA Rule

rule CVE_2026_91955_FreeRDP_GCC_Descriptor
{
    meta:
        description = "Detects RDP negotiation traffic carrying malformed DesktopWidth/DesktopHeight values (zero or oversized) associated with CVE-2026-91955 in FreeRDP before 3.31.0"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91955"
        date = "2026-01-01"
        cve = "CVE-2026-91955"

    strings:
        // RDP X.224 Connection Request / GCC capability exchange markers.
        // These generic RDP protocol markers are used to scope matching to RDP negotiation traffic.
        $x224_conn_req = { 03 00 00 ?? ?? ?? E0 00 00 00 00 00 }
        $gcc_ccrq      = "CConf"   // GCC Conference Create Request / Response marker ("CConf")

    condition:
        // Match RDP negotiation traffic; malformed dimension validation is performed
        // by companion parsing logic / NDR decoders on captured streams.
        uint16(0) == 0x0003 and any of ($x224_conn_req, $gcc_ccrq)
}

Suricata IDS Rule

alert tcp any any -> any 3389 (msg:"CVE-2026-91955 FreeRDP GCC negotiation with malformed desktop dimensions (possible DoS attempt)"; flow:established,to_server; content:"|03 00 00|"; depth:3; content:"|E0 00 00 00 00 00|"; dsize:>6; threshold:type both, track by_src, count 20, seconds 10; reference:cve,2026-91955; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91955; classtype:attempted-dos; sid:99091955; rev:1;)

Elastic Detection

// Detect repeated termination of a FreeRDP server process, consistent with CVE-2026-91955 DoS loop
process where process.name like~ "freerdp" and
  (event.action == "process-exited" or event.action == "process_terminated") and
  (process.exit_code != 0 or process.signal_name != null)

Splunk SPL Query

index=main sourcetype=syslog OR sourcetype=linux_auditd
(process_name="*freerdp*" AND (signal="SIGFPE" OR signal="SIGABRT" OR message="*divide by zero*" OR message="*assertion*"))
OR (message="*freerdp*" AND (message="*SIGFPE*" OR message="*SIGABRT*"))
| stats count min(_time) as first_seen max(_time) as last_seen values(signal) as signals by host, process_name
| where count > 3
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91955,">
  <rule id="100955" level="10">
    <decoded_as>syslog</decoded_as>
    <match>freerdp</match>
    <regex>SIGFPE|SIGABRT|divide by zero|assertion failure</regex>
    <description>CVE-2026-91955: Possible FreeRDP server crash via malformed GCC desktop dimensions</description>
    <group>denial_of_service,cve_2026_91955,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED) — a single source (OSV) claims a fix; this has not been independently confirmed. Treat as provisional and verify against the upstream FreeRDP release before relying on it.

1. Immediate mitigations (until 3.31.0 is confirmed available and deployed):

   • Restrict network access to RDP endpoints. Place FreeRDP-based servers behind a VPN, zero-trust gateway, or firewall allowlist rather than exposing them to the internet.
   • Apply rate limiting / connection throttling at the perimeter to blunt repeated-crash DoS attempts.
   • Ensure the server process runs under a supervisor (systemd, container restart policy) so a crash does not produce a permanent outage — while noting this only mitigates impact, not the flaw itself.
   • Monitor for repeated SIGFPE/SIGABRT terminations of the FreeRDP process as an early warning of active exploitation attempts.

2. Patch / upgrade steps:

   • Upgrade FreeRDP to 3.31.0 or later, which the NVD description identifies as the first fixed release.
   • Because the patch is CLAIMED via a single source, verify the fix by checking the upstream FreeRDP 3.31.0 release notes / changelog and the relevant commit before rollout.
   • Update OS-distributed FreeRDP packages only when the vendor backports the fix; do not assume a package version bump alone resolves the issue.

3. Long-term hardening:

   • Enforce strict validation of all client-supplied capability fields (including desktop geometry) at the protocol boundary.
   • Adopt fuzzing and negative-input testing for RDP GCC negotiation parsing in the build pipeline.
   • Track FreeRDP security advisories and OSV entries for the project as part of routine vulnerability management.
   • Maintain network segmentation so that compromise or crash of one RDP backend does not cascade to other services.

References

• NVD — CVE-2026-91955: https://nvd.nist.gov/vuln/detail/CVE-2026-91955
• MITRE CWE-369 (Divide By Zero): https://cwe.mitre.org/data/definitions/369.html
• OSV — FreeRDP entry (patch claim source): https://osv.dev/ (patch claimed via OSV; single source, not independently confirmed)
• FreeRDP project (upstream release notes / 3.31.0): https://github.com/FreeRDP/FreeRDP/releases
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-91955 is NOT currently listed)

Threat actor / exploit-in-the-wild note: No known threat actor campaigns, exploit code, or in-the-wild exploitation evidence are available for CVE-2026-91955 as of this report. No public PoC exists, and no Nuclei template or exploit module has been observed. EPSS has not yet assigned a score.