Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91964FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken

High 8.8

In plain English

A high-severity heap buffer overflow in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.6%top 51.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8freerdp2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9freerdp2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10freerdp-devel2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8freerdp-devel2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9freerdp-devel2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10freerdp-libs2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8freerdp-libs2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9freerdp-libs2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10freerdp-server2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:10libwinpr2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8libwinpr2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9libwinpr2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10libwinpr-devel2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8libwinpr-devel2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9libwinpr-devel2:2.11.7-7.el9_8.8ALSA-2026:76755
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-91964
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-91964
Debian:14freerdp33.31.0+dfsg-1DEBIAN-CVE-2026-91964
Rocky Linux:10freerdp2:3.10.3-12.el10_2.14RLSA-2026:75570
Rocky Linux:8freerdp2:2.11.7-14.el8_10RLSA-2026:76747
Rocky Linux:9freerdp2:2.11.7-7.el9_8.8RLSA-2026:76755
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-91964
Ubuntu:24.04:LTSfreerdp33.31.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-91964
Ubuntu:26.04:LTSfreerdp33.31.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-91964

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 2.0.0 – before 3.0.03.0.0 – before 3.31.0
FreeRDP FreeRDP 0 – before 3.31.0

Weakness: CWE-122 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References