CVE-2026-91960

Executive Summary

CVE-2026-91960 is a remote denial-of-service vulnerability in FreeRDP versions prior to 3.31.0, caused by an integer overflow in the WinPR Stream_EnsureRemainingCapacity function when parsing WebSocket Ping frames with a crafted 64-bit extended payload length. A malicious or compromised RD Gateway peer can trigger integer wraparound leading to a double free that crashes the connecting FreeRDP client. The vulnerability requires user interaction (initiating or accepting an RDP connection through the malicious gateway) and impacts availability only, with a CVSS 3.1 base score of 6.5.

Technical Analysis

The flaw resides in WinPR, FreeRDP's portability layer that provides the stream-handling primitives used across the codebase, including WebSocket transport handling for RDP connections negotiated through an RD Gateway. The affected routine, Stream_EnsureRemainingCapacity, is responsible for guaranteeing that a stream buffer has sufficient unused capacity before additional bytes are written.

WebSocket framing (RFC 6455) encodes payload length using either a 7-bit short form, a 16-bit extended form (126), or a 64-bit extended form (127). When an RD Gateway peer sends a WebSocket Ping frame with an attacker-controlled 64-bit extended payload length, the value is consumed by the stream-growth logic. Because the length is a 64-bit integer and Stream_EnsureRemainingCapacity performs capacity arithmetic without sufficient overflow checking, a crafted value causes integer wraparound in the computed required size or offset. The wrapped result yields an incorrect buffer size or pointer offset, corrupting stream state and ultimately producing a double free during cleanup or subsequent frame handling, which terminates the FreeRDP client process.

This is classified as CWE-190 (Integer Overflow or Wraparound). The attack vector is network-adjacent to the RD Gateway session (AV:N), requires no privileges (PR:N), and requires the victim to connect through or accept the malicious gateway (UI:R). Confidentiality and integrity impacts are absent (C:N/I:N); availability impact is high (A:H) because the resulting double free crashes the client. EPSS is low at 0.00442 (37.6th percentile), indicating no observed mass exploitation at time of writing.

Note: exploitation detail beyond the vulnerability class is inferred from the NVD description; no public PoC or exploit code is available, and no specific additional function names, endpoints, or parameters beyond Stream_EnsureRemainingCapacity are asserted here.

Exploitation Scenarios

No public PoC is available; the following attack chain is inferred from the vulnerability class (CWE-190) and the documented WebSocket/stream handling behavior.

1. Reconnaissance / target identification: The attacker positions themselves as, or compromises, an RD Gateway that a FreeRDP client will connect to. The attacker needs the victim to route an RDP session through this gateway (e.g., via phishing a .rdp file, a configuration change, or by controlling the gateway infrastructure itself).

2. Triggering the flaw class: During WebSocket-based RDP transport negotiation, the malicious gateway peer sends a WebSocket Ping frame carrying a crafted 64-bit extended payload length. This is the exact input surface described in the advisory: the extended 64-bit length field is attacker-controlled.

3. Payload/execution at the vulnerability-class level: The oversized crafted length is passed into WinPR's Stream_EnsureRemainingCapacity, where capacity arithmetic overflows/wraps. The wraparound yields a corrupted stream size/offset, and subsequent frame processing leads to a double free. No shellcode or code-injection primitive is described — this is a memory-safety/DoS chain, not RCE.

4. Post-exploitation impact: The double free crashes the FreeRDP client, terminating the session (denial of service). Given CVSS impact C:N/I:N/A:H, the primary effect is availability loss for the connecting client. There is no documented confidentiality or integrity impact, and no documented persistence or lateral movement.

Impact Assessment

Business impact is availability-focused: users connecting to RDP resources through an affected/compromised RD Gateway can have their FreeRDP client crash, disrupting remote administration and remote-work sessions. Because a malicious gateway is the trigger, the blast radius is limited to clients that connect through that gateway — this is not a self-propagating worm and is not remotely triggerable without victim connection (UI:R). CVSS subscores: AV:N (network), AC:L (low complexity), PR:N (no privileges), UI:R (user interaction), S:U (unchanged scope), C:N/I:N (no confidentiality/integrity impact), A:H (high availability impact) → base 6.5. CISA KEV: NO. EPSS 0.00442 suggests low near-term exploitation likelihood, but targeted denial of service against specific users or gateway-hosted environments remains plausible.

Detection Guidance

Sigma Rule

title: FreeRDP WinPR Stream Integer Overflow DoS via Malicious RD Gateway
id: 7f3c9a21-4b6e-4d0a-9c11-2e5f8a0b91d2
status: experimental
description: Detects FreeRDP client crashes potentially caused by a malicious RD Gateway sending crafted WebSocket Ping frames (CVE-2026-91960)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91960
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_img:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
  selection_crash:
    CommandLine|contains:
      - '/gateway:'
  selection_signal:
    # Crash / abort signals indicating double free
    Keywords|contains:
      - 'double free'
      - 'SIGABRT'
  condition: selection_img and selection_crash and selection_signal
falsepositives:
  - Legitimate client crashes unrelated to malicious gateway
level: medium

YARA Rule

rule CVE_2026_91960_FreeRDP_WinPR_Overflow
{
    meta:
        description = "Detects FreeRDP binaries and crash artifacts associated with CVE-2026-91960 WinPR Stream_EnsureRemainingCapacity integer overflow"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91960"
        date = "2026-01-01"
    strings:
        $func = "Stream_EnsureRemainingCapacity" ascii wide
        $winpr = "winpr" ascii nocase
        $free = "free" ascii
    condition:
        uint16(0) == 0x5A4D or      // PE
        uint32(0) == 0x464C457F or   // ELF
        $func and $winpr
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-91960 FreeRDP WinPR integer overflow DoS via crafted WebSocket Ping extended length"; flow:established,to_client; content:"|89|"; byte_test:1,>=,126,0,relative; byte_test:1,&,127,0,relative; classtype:attempted-dos; reference:cve,2026-91960; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91960; sid:202691960; rev:1;)

Elastic Detection

process where process.name in ("xfreerdp", "wlfreerdp")
  and process.args : "/gateway:*"
  and process.exit_code != 0

Splunk SPL Query

index=endpoint OR index=syslog ("Stream_EnsureRemainingCapacity" OR "double free" OR "SIGABRT")
  ("xfreerdp" OR "wlfreerdp" OR "freerdp")
| stats count min(_time) as first_seen max(_time) as last_seen
    by host, process_name, CommandLine
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve_2026_91960,">
  <rule id="10091960" level="10">
    <decoded_as>syslog</decoded_as>
    <match>Stream_EnsureRemainingCapacity|double free|SIGABRT</match>
    <description>CVE-2026-91960: Possible FreeRDP WinPR integer overflow double free (malicious RD Gateway)</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>dos,cve_2026_91960,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 3/4 (LIKELY — 2 independent sources confirm fix). Upgrade FreeRDP to 3.31.0 or later.

1. Immediate mitigations:

• Upgrade FreeRDP clients to version 3.31.0+ where feasible.
• Restrict clients to trusted, non-attacker-controlled RD Gateways; treat gateway configuration/.rdp files from untrusted sources as hostile.
• Where patching is delayed, reduce exposure by avoiding RDP sessions routed through untrusted or third-party gateways.

2. Patch/upgrade steps:

• Install the vendor fix published in FreeRDP 3.31.0 (WinPR Stream_EnsureRemainingCapacity overflow correction).
• Apply distribution package updates (Debian and other downstream channels published fix references per OSV/Debian advisories).
• Verify client version post-upgrade and re-test RD Gateway connectivity.

3. Long-term hardening:

• Enforce WebSocket frame-length validation and hardened stream arithmetic checks across WinPR.
• Monitor for crashes/double free in RDP clients and correlate with gateway connections.
• Maintain inventory of FreeRDP deployments and subscribe to release/advisory feeds.

References

• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-91960
• FreeRDP project releases (version 3.31.0 fix): https://github.com/FreeRDP/FreeRDP
• OSV advisory entry for CVE-2026-91960: https://osv.dev/vulnerability/CVE-2026-91960
• Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-91960
• CISA KEV Catalog (not listed as of report date): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat actor campaigns / exploit-in-the-wild evidence: None reported. CISA KEV: NO; no public PoC, exploit code, or Nuclei template available at time of writing.