CVE-2026-91950

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description An out-of-bounds read occurs in the rdpdr dump packet() function due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with the computerNameLen variable set to 0xFFFFFFF0 to bypass security checks. This allows memory reads beyond the packet buffer, which can lead to client crashes or the disclosure of heap memory in logs.

Recommendations Update to version 3.31.0 or later.