FreeRDP: 20 Vulnerabilities Disclosed, Including Critical RDSTLS Bypass
A batch of 20 vulnerabilities, ranging from High to Critical severity, were disclosed for FreeRDP on September 15, 2026, impacting both client and server components.
Key findings
- 20 vulnerabilities disclosed for FreeRDP on September 15, 2026, patched in version 3.31.0.
- Flaws include heap overflows, integer overflows, and out-of-bounds reads/writes across client and server components.
- Critical vulnerability (CVE-2026-91949) allows unauthenticated RDSTLS connection bypass.
- Multiple denial-of-service vulnerabilities affect core RDP functionalities.
- Users must update to FreeRDP 3.31.0 or later to mitigate risks.
On September 15, 2026, a significant batch of 20 vulnerabilities was disclosed for the FreeRDP remote desktop protocol client and server. These vulnerabilities, all patched in version 3.31.0, span a range of severity levels from Low to Critical, with many allowing for denial-of-service conditions, information disclosure, and potential remote code execution. The sheer volume and variety of these flaws highlight a critical need for users to update their FreeRDP installations promptly.
Several vulnerabilities stem from improper handling of buffer sizes and lengths, leading to heap-based buffer overflows and out-of-bounds reads/writes. CVE-2026-91964 and CVE-2026-91953, both rated High, involve heap buffer overflows in the nego_send_negotiation_request function due to insufficient validation of the LoadBalanceInfo field length. Similarly, CVE-2026-91951 describes an out-of-bounds write in the urbdrc client channel's urb_send_current_frame_number_result function, triggered by crafted USB redirection messages. CVE-2026-91958, rated Medium, involves unbounded array indexing in xf_detect_monitors when parsing RDP connection files, potentially leading to heap read and write operations.
Integer overflows and related issues also appear in multiple CVEs. CVE-2026-91962, a Medium severity vulnerability, arises from an integer overflow in FreeRDP's Apple audio backends when processing FramesPerPacket values. Another integer overflow, CVE-2026-91960, affects WinPR's Stream_EnsureRemainingCapacity function, allowing remote attackers to cause a denial of service via crafted WebSocket Ping frames. CVE-2026-91950 details an out-of-bounds read vulnerability caused by 32-bit unsigned integer wraparound in buffer bounds validation within the rdpdr_dump_packet function.
Denial-of-service (DoS) vulnerabilities are prevalent throughout this batch. CVE-2026-91961, a Medium severity flaw, exists in the URBDRC control-transfer request path due to a failure to validate OutputBufferSize. CVE-2026-91955, rated High, allows remote attackers to crash the server by sending crafted RDP packets with invalid DesktopWidth and DesktopHeight values, leading to division-by-zero or assertion failures. CVE-2026-91954, a Medium severity vulnerability, involves a null pointer dereference in gdi_surface_bits when processing Surface Bits commands with the NSCodec ID. CVE-2026-91953 also contributes to DoS through a heap buffer overflow. CVE-2026-91913 describes an infinite loop DoS in pool_decode_rect when decoding AVC444 metablocks.
Specific components and protocols are targeted by other vulnerabilities. CVE-2026-91963, a Medium severity flaw, involves an uninitialized heap memory disclosure in the urbdrc USB redirection channel. CVE-2026-91959, also Medium, is a buffer over-read in the RPC gateway transport parser's rts_read_result function. CVE-2026-91949, a Critical vulnerability, allows unauthenticated attackers to bypass protocol negotiation and establish RDSTLS connections despite server policy disabling them. CVE-2026-91948, High severity, involves an out-of-bounds write in server-side static virtual channel handling. CVE-2026-91947, another High severity flaw, is a use-after-free vulnerability in the DRDYNVC parser. CVE-2026-91946, Medium, is an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer. Finally, CVE-2026-91945, Medium, is an out-of-bounds read in smartcard response decoders.
All disclosed vulnerabilities are addressed in FreeRDP version 3.31.0. Users are strongly advised to update to this version or later to mitigate the risks associated with these numerous security flaws. The broad impact across various components and the presence of critical and high-severity issues underscore the importance of timely patching for all FreeRDP deployments.
The batch of 20 vulnerabilities disclosed on September 15, 2026, for FreeRDP includes critical and high-severity flaws affecting core functionalities. Multiple vulnerabilities stem from improper buffer size and length validation, leading to heap overflows and out-of-bounds reads/writes. Integer overflows and related arithmetic issues contribute to denial-of-service conditions and potential memory corruption. Several vulnerabilities specifically target components like URBDRC, RPC gateway, RDPGFX, and smartcard handling. A critical vulnerability (CVE-2026-91949) allows unauthenticated attackers to bypass RDSTLS connection policies. All disclosed issues are resolved in FreeRDP version 3.31.0. The disclosure event on September 15, 2026, highlights significant security weaknesses across FreeRDP's client and server components. Users should prioritize updating to FreeRDP version 3.31.0 or later to protect against these 20 vulnerabilities. The variety of vulnerabilities, including buffer overflows, integer overflows, and protocol bypasses, necessitates a comprehensive security review for affected systems. The potential for remote code execution and denial of service across multiple CVEs underscores the urgency of applying the available patches. The critical vulnerability CVE-2026-91949, allowing unauthenticated RDSTLS connections, poses a particularly severe risk. The disclosure of these 20 CVEs together emphasizes a coordinated effort to address security flaws within the FreeRDP project. The patched version, FreeRDP 3.31.0, is now available and should be deployed across all user environments. The vulnerabilities impact various aspects of the RDP protocol, from negotiation and channel handling to graphics and smartcard functionalities. The batch includes issues with CVSS scores ranging from 3.1 (Low) to 9.3 (Critical). The vulnerabilities were disclosed on a single day, indicating a coordinated release of security information. The affected versions are all prior to 3.31.0. The vulnerabilities were disclosed on September 15, 2026. The patched version is 3.31.0. The vulnerabilities affect both FreeRDP client and server components. The vulnerabilities include heap-based buffer overflows, integer overflows, out-of-bounds reads/writes, null pointer dereferences, use-after-free, and protocol negotiation bypasses. CVE-2026-91964, CVE-2026-91953, CVE-2026-91955, CVE-2026-91948, CVE-2026-91947, CVE-2026-91949. CVE-2026-91964, CVE-2026-91963, CVE-2026-91962, CVE-2026-91961, CVE-2026-91960, CVE-2026-91959, CVE-2026-91958, CVE-2026-91957, CVE-2026-91956, CVE-2026-91955, CVE-2026-91954, CVE-2026-91953, CVE-2026-91952, CVE-2026-91951, CVE-2026-91950, CVE-2026-91949, CVE-2026-91948, CVE-2026-91947, CVE-2026-91946, CVE-2026-91945. A stylized FreeRDP client window with multiple error messages cascading down the screen, interspersed with fragmented code snippets and buffer overflow symbols. The background is a dark, abstract representation of a network.