CVE-2026-91964

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can exploit a heap-based buffer overflow vulnerability in the nego_send_negotiation_request function. By sending a specially crafted Server Redirection PDU message with an attacker-controlled LoadBalanceInfo field, the server can write an arbitrary-length field into a fixed-size buffer without proper validation. This can lead to a denial of service (client crash) or, when chained with a memory disclosure vulnerability, potentially remote code execution on the client system.

This vulnerability is rated as an Important severity rather than Critical because exploitation requires user interaction, specifically initiating an RDP session to an untrusted or rogue server. In Red Hat Enterprise Linux environments, FreeRDP is typically deployed as a client-side remote desktop utility or shared library supporting graphical connection managers. A rogue endpoint can return malformed redirection data that induces memory corruption during session renegotiation, which may crash the client application or allow arbitrary code execution bounded by the local user's account privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Users of FreeRDP clients should avoid connecting to untrusted or unknown RDP servers. This operational control reduces the risk of exploitation, as a malicious server is required to trigger the heap-based buffer overflow.