CVE-2026-91950

A flaw was found in FreeRDP, where an out-of-bounds read vulnerability exists in the rdpdr_dump_packet function. This is due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a specially crafted RDPDR packet, bypassing security checks and causing the client to read memory beyond the intended buffer. This can result in client crashes, leading to a denial of service, or the disclosure of sensitive heap memory information in logs. Exploitation requires the client to have WLOG_TRACE-level logging enabled.

This vulnerability is rated as Important severity because a compromised or malicious remote desktop server can remotely crash the client or disclose process memory without authentication. However, standard Red Hat Enterprise Linux installations run FreeRDP with informational logging levels by default, preventing execution of the vulnerable packet inspection routine unless verbose trace debugging is explicitly activated. Exploitation also requires user interaction to initiate a remote desktop session with device redirection enabled toward an untrusted host.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid connecting to untrusted or potentially malicious RDP servers. Restricting FreeRDP client connections to only known and trusted RDP servers significantly reduces the attack surface. If connecting to untrusted servers is unavoidable, consider using a highly isolated environment for the client.