CVE-2026-91958

Executive Summary

CVE-2026-91958 is an out-of-bounds heap read/write vulnerability in FreeRDP versions prior to 3.31.0. The flaw resides in the xf_detect_monitors routine, which fails to validate MonitorIds array values while parsing RDP connection files. A crafted .rdp file containing an out-of-range selectedmonitors value can cause unbounded array indexing when opened with the xfreerdp client, leading to memory corruption, potential code execution, denial of service (crash), and information disclosure. With a CVSS base score of 6.6, the vulnerability requires local access and user interaction (opening a malicious RDP file), making it a moderate-severity but high-impact risk for enterprises whose users routinely open untrusted .rdp connection files.

Technical Analysis

The vulnerability is classified as CWE-125 (Out-of-bounds Read) and manifests as unbounded array indexing within the xf_detect_monitors function of the FreeRDP xfreerdp client. When FreeRDP parses an RDP connection file (.rdp), the MonitorIds / selectedmonitors field is expected to contain one or more numeric monitor identifiers. In affected versions (< 3.31.0), the code does not validate that these values are within the bounds of the internal monitor array before using them as an index.

Because the value is attacker-controlled and unchecked, an attacker can supply a selectedmonitors value that points outside the allocated monitor array. This yields out-of-bounds heap read and write operations — an attacker-controlled index into a heap-allocated structure. Out-of-bounds writes to adjacent heap memory can corrupt heap metadata or other objects, which may be leveraged for further memory corruption; out-of-bounds reads can disclose adjacent heap contents or return malformed pointers that later crash the process.

Key characteristics:

• Attack surface: RDP connection file (.rdp) parsing code path in xf_detect_monitors.
• Trigger: opening a maliciously crafted RDP file in the xfreerdp client.
• Root cause class: missing bounds validation on array index derived from selectedmonitors.
• Consequence: out-of-bounds heap read/write → memory corruption, crash (DoS), possible info disclosure, and potential code execution depending on heap layout.

The NVD description does not confirm arbitrary code execution, and no specifics (exact array size, heap primitive, or controlled-object layout) are disclosed. Per the accuracy constraints of this report, the mechanism is described strictly at the class level: unvalidated array index → out-of-bounds heap access in xf_detect_monitors.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for this CVE (PoC: None, Exploit Code: NO, Nuclei: NO). The attack chain below is inferred strictly from the vulnerability class described in NVD.

1. Reconnaissance / target identification. The attacker identifies a target organization or user that uses the FreeRDP xfreerdp client (versions before 3.31.0). Because the attack requires the victim to open a file locally (AV:L, UI:R), the attacker focuses on delivery rather than network discovery.

2. Delivery of the malicious RDP file. The attacker crafts an .rdp connection file containing an out-of-range selectedmonitors value. This file is delivered to the victim via email attachment, shared drive, chat message, download link, or similar file-transfer channel. No special privileges are required (PR:N) — only that the victim opens the file.

3. Trigger of the specific flaw class. When the victim opens the malicious .rdp file using xfreerdp, the client parses connection-file settings and enters xf_detect_monitors. The unvalidated selectedmonitors value is used as an array index into monitor-related heap structures without a bounds check, causing out-of-bounds read and write operations.

4. Post-exploitation impact. Depending on the concrete heap layout and values chosen, outcomes include: (a) client crash / denial of service, (b) heap memory corruption that may be exploitable if the attacker can craft the memory layout, potentially leading to code execution in the context of the user running xfreerdp, and (c) information disclosure via out-of-bounds reads. The NVD description does not confirm a code-execution primitive, so this must be treated as a potential — not confirmed — outcome. Any code execution would run with the privileges of the xfreerdp process (typically the invoking user), and could facilitate lateral movement or credential theft if the user has additional access.

Impact Assessment

CVSS 3.1 base score: 6.6 (Medium) — CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H.

Subscore interpretation:

• AV:L (Local): The attacker cannot trigger the flaw remotely; they must deliver a file that is opened locally.
• AC:L (Low): No special conditions or race conditions are required beyond file delivery and opening.
• PR:N (None): No authentication or privileges required on the victim host.
• UI:R (Required): The victim must open the malicious RDP file — a classic phishing/file-delivery precondition.
• S:U (Unchanged): Scope remains within the xfreerdp process.
• C:L / I:L: Limited confidentiality and integrity impact, consistent with an out-of-bounds read and constrained memory corruption.
• A:H (High): Availability impact is high — reliable client crash / denial of service is a directly implied outcome of out-of-bounds heap access.

Business impact: Affected systems are Linux/Unix workstations and servers running the FreeRDP xfreerdp client before 3.31.0. Blast radius is bounded to hosts where a user opens a malicious .rdp file, but in managed desktop environments where .rdp files are common administrative tools, the file type may not raise user suspicion, increasing phishing success rates. A successful DoS can interrupt remote administration workflows; a successful memory-corruption exploit could compromise the workstation. EPSS is 0.00199 (10.0th percentile), indicating low observed exploitation likelihood in the wild, and the CVE is not in CISA KEV.

Detection Guidance

Sigma Rule

title: Suspicious RDP File Opened with xfreerdp (Potential CVE-2026-91958)
id: 7f6b2a92-4c1e-4a8b-9d3a-2f9b7c1e5a10
status: experimental
description: Detects execution of xfreerdp against recently downloaded or suspicious .rdp connection files, which may carry out-of-range selectedmonitors values triggering CVE-2026-91958.
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: linux
detection:
  selection_binary:
    Image|endswith:
      - '/xfreerdp'
      - '/xfreerdp3'
  selection_args:
    CommandLine|contains:
      - '.rdp'
  condition: selection_binary and selection_args
falsepositives:
  - Legitimate administrative use of xfreerdp with trusted .rdp files
level: medium
tags:
  - attack.t1204.002
  - cve.2026.91958

YARA Rule

rule CVE_2026_91958_Malicious_RDP_SelectedMonitors
{
    meta:
        description = "Detects .rdp connection files containing out-of-range selectedmonitors values targeting FreeRDP CVE-2026-91958"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "CVE-2026-91958"
        severity = "medium"

    strings:
        $selected = "selectedmonitors:" ascii nocase
        $monitorids = "MonitorIds" ascii nocase
        $rdp_hdr = "full address:s:" ascii nocase
        $rdp_screen = "screen mode id:i:" ascii nocase

    condition:
        uint32be(0) != 0x4D5A0000 and
        filesize < 64KB and
        ($rdp_hdr or $rdp_screen) and
        ($selected or $monitorids)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 3389 (msg:"CVE-2026-91958 FreeRDP RDP Connection Tracking - Potential Malicious Client Session"; flow:to_server,established; app-layer-protocol:rdp; classtype:attempted-user; sid:202691958; rev:1; metadata:affected_product FreeRDP, cve CVE-2026-91958, created_at 2026_01_01;)

Elastic Detection

process where event.type == "start" and
  process.name in ("xfreerdp", "xfreerdp3") and
  process.args : "*.rdp"

Splunk SPL Query

index=endpoint OR index=linux_source (process_name="xfreerdp" OR process_name="xfreerdp3") ("*.rdp")
| stats count min(_time) as firstTime max(_time) as lastTime by host, user, process_name, process
| where count > 0
| convert ctime(firstTime) ctime(lastTime)

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91958,">
  <rule id="100958" level="8">
    <if_sid>80700</if_sid>
    <field name="audit.exe">\/xfreerdp</field>
    <match>\.rdp</match>
    <description>CVE-2026-91958: xfreerdp launched with a .rdp file - possible malicious MonitorIds/selectedmonitors payload</description>
    <mitre>
      <id>T1204.002</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix). Patch sources: OSV and Debian.

1) Immediate mitigations

• Upgrade FreeRDP to version 3.31.0 or later, where MonitorIds / selectedmonitors values are validated before use in xf_detect_monitors.
• Until patching is feasible, restrict users from opening untrusted .rdp files; block .rdp attachments at the email/web gateway if they are not business-essential.
• Distribute only trusted, validated .rdp connection profiles through managed configuration channels.
• Enable application allowlisting so that only approved xfreerdp binaries can execute.

2) Patch / upgrade steps (Debian-based systems)

• Update the freerdp / freerdp3 packages via the distribution vendor (Debian security advisory source confirms the fix).
• Reboot or restart any long-running sessions using xfreerdp.
• Verify the installed version is >= 3.31.0 using xfreerdp --version (or the package manager).
• Track advisories from the FreeRDP project and OSV for the definitive fixed-version range.

3) Long-term hardening

• Enforce bounds-checking review patterns for all parsed external input (especially array indices derived from file contents) in RDP client and related parsing code.
• Deploy fuzzing (e.g., AFL++/libFuzzer) against RDP connection-file parsers to catch similar OOB index bugs.
• Apply the principle of least privilege for users running remote-desktop clients in sensitive environments.
• Maintain an asset inventory of FreeRDP deployments and subscribe to vendor advisories.

References

1. NVD — CVE-2026-91958: https://nvd.nist.gov/vuln/detail/CVE-2026-91958
2. FreeRDP Project / GitHub Releases (3.31.0 fix): https://github.com/FreeRDP/FreeRDP/releases
3. OSV Advisory (patch confirmation source for CVE-2026-91958)
4. Debian Security Tracker / DSA (patch confirmation source for CVE-2026-91958)
5. CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html

Threat actor / exploit-in-the-wild note: No exploit code, public PoC, or Nuclei template is currently available. CISA KEV: NO. EPSS 0.00199 (10.0th percentile) indicates low exploitation likelihood at the time of writing. No known threat actor campaigns are associated with this CVE in the provided data.