CVE-2026-91959

Executive Summary

CVE-2026-91959 is a buffer over-read (CWE-125) in FreeRDP versions before 3.31.0, located in the rts_read_result function of the RPC gateway transport parser. An attacker able to deliver a crafted BIND_ACK PDU with a truncated result entry can trigger an out-of-bounds read that causes the FreeRDP process to abort. Because exploitation requires the user to connect to, or otherwise process traffic from, a malicious RDP/RPC peer, the attack is remote and low-complexity but demands user interaction, resulting in a denial-of-service condition (CVSS 6.5, availability-only impact).

Technical Analysis

The vulnerability resides in FreeRDP's RPC-over-RDP transport parsing logic, specifically the rts_read_result function within the RPC gateway transport parser. In this parsing path, an incoming BIND_ACK PDU carries one or more result entries that the client reads and interprets. The parser does not adequately validate that the result entry is fully present within the received buffer before dereferencing/reading it.

When an attacker supplies a BIND_ACK PDU whose result entry is truncated (i.e., shorter than the parser expects), the read logic advances beyond the bounds of the allocated or received buffer. This constitutes an out-of-bounds read — classified as CWE-125.

The practical outcome described is a process abort. An over-read of this nature typically manifests as a crash when the parser reads past the end of a buffer, leading to an unhandled fault or a defensive abort in the FreeRDP client process. There is no indication in the available data that the over-read yields information disclosure (the CVSS confidentiality subscore is None), nor that it permits memory corruption or code execution (integrity subscore is None). The impact is limited to availability.

The attack surface is the RPC gateway transport parser, reachable when a FreeRDP client processes RDP/RPC traffic from a peer. The preconditions for reaching rts_read_result — the specific connection phase and RDP/RPC negotiation state — are not fully enumerated in the available description; analysis beyond the vulnerability class (truncated PDU field → parser over-read) would require source-level review of FreeRDP 3.31.0 and earlier that is not derivable from the supplied NVD text.

Technical detail beyond the above is limited. The NVD description names the affected function (rts_read_result), the parser subsystem (RPC gateway transport parser), the malformed input (BIND_ACK PDU with a truncated result entry), and the effect (out-of-bounds read causing process abort). No public proof-of-concept, exploit code, or Nuclei template is available.

Exploitation Scenarios

Note: No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description. Specific function calls, protocol field names, or byte offsets beyond those named in the description should not be assumed.

1. Reconnaissance / target identification. An attacker identifies a target environment where FreeRDP clients connect to attacker-influenced or attacker-controlled RDP/RPC endpoints — for example, users connecting to a malicious or compromised RDP server, or an adversary positioned to inject/relay RPC gateway traffic. The attacker needs a position where they can deliver RPC gateway PDUs to the client during connection establishment.

2. Triggering the flaw class. During the RPC gateway transport negotiation, the attacker sends a BIND_ACK PDU. This PDU contains a result entry that is deliberately truncated — shorter than the length the rts_read_result parser expects. Because the parser does not validate the entry length against the remaining buffer before reading, the read runs past the end of the buffer (out-of-bounds read).

3. Payload/execution method (vulnerability-class level). The "payload" is a malformed protocol message rather than executable code: a crafted BIND_ACK with an undersized result entry. No memory-corruption primitive or code injection is described; the mechanism is a read past buffer bounds.

4. Post-exploitation impact. The out-of-bounds read causes a process abort — a denial-of-service condition on the affected FreeRDP client. Given C:N/I:N in the CVSS vector, no confidentiality or integrity impact is described. Repeated delivery of the malformed PDU against multiple clients could cause sustained service disruption, but that is an operational consequence of repeated DoS, not a distinct primitive.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H:

• AV:N (Network): the flaw is reachable over the network via RDP/RPC traffic.
• AC:L (Low): no special conditions or race are required per the description.
• PR:N (None): no authentication privileges are required.
• UI:R (Required): a user must initiate or accept the connection that processes the malicious PDU.
• S:U (Unchanged): impact is scoped to the vulnerable component.
• C:N / I:N: no confidentiality or integrity impact described.
• A:H (High): successful triggering aborts the FreeRDP process.

Business impact centers on availability: users relying on FreeRDP-based RDP clients (remote administration, VDI/remote access workflows, thin-client or embedded deployments) may experience client process termination, interrupting sessions and disrupting work. Blast radius is bounded to the individual client process that receives the malformed PDU; there is no described lateral movement, data exfiltration, or persistence component. EPSS is 0.00346 (28.0th percentile), and there is no CISA KEV listing, indicating low observed exploitation likelihood at the time of writing.

Detection Guidance

Sigma Rule

title: FreeRDP RPC Gateway Truncated BIND_ACK DoS Attempt (CVE-2026-91959)
id: 7c4a2f19-9e6b-4d2a-9c3e-2b9d1f6a0e77
status: experimental
description: Detects FreeRDP process aborts consistent with an out-of-bounds read in rts_read_result triggered by a truncated BIND_ACK result entry.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91959
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1499
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/freerdp'
  selection_fault:
    CommandLine|contains:
      - 'rts_read_result'
      - 'BIND_ACK'
  selection_crash:
    - ExitCode: '139'
    - ExitCode: '134'
  condition: selection_proc and (selection_fault or selection_crash)
falsepositives:
  - Legitimate FreeRDP client crashes unrelated to exploitation
  - Malformed but benign RDP server responses
level: medium

YARA Rule

rule CVE_2026_91959_FreeRDP_rts_read_result_DoS
{
    meta:
        description = "Detects strings associated with CVE-2026-91959 FreeRDP RPC gateway BIND_ACK over-read"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91959"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $fn   = "rts_read_result" ascii wide
        $bind = "BIND_ACK" ascii wide

    condition:
        (uint32(0) == 0x464C457F or uint32(0) == 0xCAFEBABE) and $fn and $bind
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-91959 FreeRDP RPC Gateway Truncated BIND_ACK Result DoS Attempt"; flow:established,to_client; content:"|06 00|"; classtype:attempted-dos; reference:cve,2026-91959; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91959; sid:202691959; rev:1;)

Note: RPC gateway PDU framing depends on the negotiated transport layer; the content match above is a placeholder anchor. Tune to your actual RDP/RPC gateway encapsulation (TCP port, TLS-wrapped or COBS-framed) and validate before production deployment.

Elastic Detection

process where host.os.type == "linux" and
event.type == "end" and
process.name in ("xfreerdp", "wlfreerdp", "freerdp") and
process.exit_code in ("139", "134", "-11", "-6")

Splunk SPL Query

index=main (process_name=xfreerdp OR process_name=wlfreerdp OR process_name=freerdp)
(exit_code=139 OR exit_code=134 OR "rts_read_result" OR "BIND_ACK")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, exit_code
| where count > 2
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91959,">
  <rule id="100959" level="8">
    <if_sid>5501</if_sid>
    <field name="win.eventdata.image">freerdp|xfreerdp|wlfreerdp</field>
    <field name="win.eventdata.exitCode">139|134</field>
    <description>Possible FreeRDP CVE-2026-91959 exploitation - RPC gateway BIND_ACK over-read caused process abort</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 — CLAIMED. A single source (OSV) asserts an upstream fix in FreeRDP 3.31.0, but this is not independently confirmed and no vendor advisory or commit reference was supplied. Treat the version threshold as provisional and validate against the official FreeRDP release notes before relying on it.

1. Immediate mitigations. Reduce the ability of untrusted peers to reach the RPC gateway transport parser. Restrict outbound RDP connections to known, trusted hosts where operationally feasible; avoid connecting FreeRDP clients to untrusted or unknown RDP/RPC endpoints. Where a proxy or gateway is used, enforce allow-listing and monitor/limit RPC gateway traffic. Because the CVSS vector requires user interaction (UI:R), user awareness about connecting to unverified RDP endpoints is a meaningful control.

2. Patch / upgrade steps. Upgrade FreeRDP to 3.31.0 or later, per the claimed fix. Confirm the patch by checking the FreeRDP project's official release notes and changelog for version 3.31.0 and the referenced rts_read_result fix. Verify package repository versions (distro-maintained vs. upstream) and rebuild/redeploy dependent applications and embedded images that bundle FreeRDP. After upgrading, re-validate against the affected version threshold once the fix is independently confirmed.

3. Long-term hardening. Track FreeRDP releases and subscribe to its security advisories. Enforce input-validation expectations for protocol parsers in review processes, particularly length checks before buffer reads in PDU handling code. Deploy crash/abort monitoring at the endpoint and network level to detect repeated client terminations that could indicate a DoS attempt. Maintain layers of least-privilege and segmentation so that RDP client availability failures do not cascade into broader operational outages.

References

• NVD — CVE-2026-91959: https://nvd.nist.gov/vuln/detail/CVE-2026-91959
• OSV — package advisory (claimed patch source, version 3.31.0)
• CWE-125 — Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• FreeRDP project release notes/changelog for version 3.31.0 (verify the fix; not independently confirmed at time of writing)

No public proof-of-concept, exploit code, or Nuclei template is available, there is no CISA KEV listing, and no known threat actor campaign or exploit-in-the-wild evidence has been identified. EPSS is 0.00346 (28.0th percentile).