CVE-2026-91952

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send specially crafted AVC444 graphics updates. This can cause the pool_decode_rect function to enter an infinite loop when decoding AVC444 metablocks with an excessive number of region rectangles. The vulnerability leads to a denial of service (DoS) by consuming CPU resources and preventing normal client operation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid connecting FreeRDP clients to untrusted or unverified RDP servers. Restricting RDP client connections to known, legitimate servers reduces the risk of encountering a malicious server exploiting this vulnerability.