CVE-2026-91964: 
Wolfi vulnerability analysis and mitigation

CVE-2026-91964 is a heap-based buffer overflow vulnerability in FreeRDP's nego_send_negotiation_request function, triggered when processing Server Redirection PDU messages containing attacker-controlled LoadBalanceInfo fields. A malicious RDP server can send an arbitrarily long field that is copied into a fixed 512-byte heap buffer without bounds validation, resulting in client crashes or remote code execution when chained with a memory disclosure primitive. The vulnerability affects FreeRDP versions 2.0.0 through 3.30.0 (the entire 2.x and 3.x lines prior to 3.31.0); downstream clients that link libfreerdp — including Remmina, GNOME Connections, KRDC, and Apache Guacamole guacd — are also affected. It was disclosed on September 15, 2026, with a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 8.7 (High) (GitHub Advisory GHSA-2vf2-grvj-6g8x, GitHub Advisory Database, Red Hat Bugzilla).

The root cause is classified as CWE-122 (Heap-based Buffer Overflow) and CWE-120 (Buffer Copy without Checking Size of Input). Exploitation follows a five-step chain: (1) a malicious RDP server sends a Server Redirection PDU with an attacker-controlled LB_LOAD_BALANCE_INFO field of arbitrary length, which the client stores verbatim without validation; (2) on reconnect, the stored cookie is passed to the negotiation layer as the RoutingToken; (3) nego_set_routing_token() copies the token exactly with no upper-bound enforcement; (4) nego_send_negotiation_request() allocates a fixed 512-byte stream and calls Stream_Write with the full token length and no capacity check, overflowing the heap; (5) on Linux desktop builds with clipboard file redirection (FUSE) compiled in, the adjacent wHashTable (clipboard request_table) is overwritten, allowing the attacker to redirect a HashTable_Free callback to system() at session teardown. The overflow bytes are fully attacker-controlled, and the bug is present byte-for-byte from FreeRDP 2.0.0 through current master at the time of disclosure (GitHub Advisory GHSA-2vf2-grvj-6g8x).

Successful exploitation by a malicious RDP server results in high impact to confidentiality, integrity, and availability of the connecting client. Without a memory disclosure primitive, the overflow causes a reliable denial-of-service (client crash); when chained with a companion memory leak vulnerability, it enables full remote code execution on the RDP client machine — demonstrated as root-level RCE on Ubuntu 26.04 with ASLR and NX enabled. Downstream applications that embed libfreerdp (Remmina, GNOME Connections, KRDC, Apache Guacamole guacd) inherit the same risk, potentially broadening the attack surface to enterprise remote-access infrastructure (GitHub Advisory GHSA-2vf2-grvj-6g8x, Red Hat Bugzilla).

As of the disclosure date (September 15, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The vulnerability requires user interaction — a victim must connect to a malicious RDP server — but no credentials or prior authentication are needed on the attacker's side. The EPSS score is 0.0 at time of publication, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by Julien Lair, Security Researcher at Quarkslab, and was confirmed dynamically on multiple FreeRDP versions (GitHub Advisory GHSA-2vf2-grvj-6g8x).

1. Set up a malicious RDP server: Deploy a custom or modified RDP server (e.g., using a framework such as PYRDP or a patched FreeRDP server build) capable of sending crafted Server Redirection PDU messages.
2. Lure the victim to connect: Social-engineer or redirect the target user into connecting their FreeRDP-based client (xfreerdp, Remmina, etc.) to the attacker-controlled server — no credentials are required on the server side.
3. Send a malicious Server Redirection PDU: Transmit a Server Redirection PDU with an LB_LOAD_BALANCE_INFO field exceeding 501 bytes (the usable space after the ~11-byte TPDU header in the 512-byte buffer). The field content is fully attacker-controlled.
4. Trigger client reconnect: The client processes the redirection, stores the oversized LoadBalanceInfo verbatim, and reconnects to the (possibly same) server, passing the data as the RoutingToken.
5. Overflow the heap buffer: During the new connection's negotiation phase, nego_send_negotiation_request() copies the oversized RoutingToken into the fixed 512-byte stream without a capacity check, overflowing into adjacent heap memory.
6. Overwrite the clipboard hash table (for RCE): On Linux builds with FUSE clipboard redirection, craft the overflow payload to overwrite the adjacent wHashTable fields (numOfBuckets, bucketArray, fnObjectFree) with attacker-controlled values. Use a companion memory disclosure vulnerability to defeat ASLR and obtain the address of system().
7. Achieve code execution at session teardown: When the client disconnects, HashTable_Free walks the corrupted bucket array and invokes the overwritten fnObjectFree callback, redirecting execution to system() with attacker-supplied arguments (GitHub Advisory GHSA-2vf2-grvj-6g8x).

• Network: Outbound RDP connections (TCP/3389 or custom port) from client machines to unfamiliar or newly registered server IPs; Server Redirection PDU traffic observed in RDP session captures with unusually large LB_LOAD_BALANCE_INFO fields (>501 bytes).
• Process: Unexpected child processes spawned by the FreeRDP client process (e.g., xfreerdp, remmina) at or after session teardown, such as /bin/sh, bash, curl, or wget; abnormal termination (segfault/crash) of FreeRDP client processes.
• Logs: System logs (/var/log/syslog, journalctl) showing segmentation faults or heap corruption errors in xfreerdp or remmina processes; core dump files generated in the user's home directory or /tmp following RDP session disconnection.
• File System: Unexpected files written to /tmp or user home directories immediately after an RDP session ends; new cron jobs, .bashrc modifications, or SSH authorized keys added under the user account running the RDP client.
• Memory/Crash Artifacts: Core dumps referencing nego_send_negotiation_request, HashTable_Free, or cliprdr_file_context_free in stack traces, indicating exploitation of this specific code path (GitHub Advisory GHSA-2vf2-grvj-6g8x).

Upgrade FreeRDP to version 3.31.0 or later, which contains the fix bounding RoutingTokenLength or dynamically sizing the negotiation stream in nego.c. Downstream products (Remmina, GNOME Connections, KRDC, Apache Guacamole guacd) should update their linked system libfreerdp to the patched version. As interim workarounds: restrict RDP client connections to explicitly trusted, known-good servers; disable RDP client access when not operationally required; and apply network segmentation to limit which servers users can reach via RDP. Disabling clipboard file redirection (FUSE) at compile time or via configuration removes the specific heap-adjacent target used for RCE escalation, reducing the worst-case impact to denial-of-service (GitHub Advisory GHSA-2vf2-grvj-6g8x, Red Hat Bugzilla).

The vulnerability was reported by Julien Lair of Quarkslab and disclosed responsibly through the FreeRDP security advisory process. Red Hat opened a tracking bug (BZ#2533911) and classified it as high severity/priority. VulnCheck published an advisory corroborating the affected version range. No significant broader media coverage or notable social media discussion has been identified at the time of this report (GitHub Advisory GHSA-2vf2-grvj-6g8x, Red Hat Bugzilla).