CVE-2026-91960

A flaw was found in FreeRDP. A remote attacker, specifically a malicious RD Gateway peer, could send a crafted WebSocket Ping frame with an extended payload length. This action triggers an an integer overflow in the Stream_EnsureRemainingCapacity function, leading to an integer wraparound and a double free vulnerability. Successful exploitation results in a denial of service, causing the FreeRDP client to crash during connection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, FreeRDP clients should only connect to trusted and verified Remote Desktop Gateway servers. Connecting to untrusted or unverified servers may expose the client to denial of service attacks.