CVE-2026-91953

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description A heap buffer overflow occurs in the nego send negotiation request() function due to a failure to validate the length of the LB LOAD BALANCE INFO field before writing it to a fixed 512-byte buffer. A malicious RDP server or a man-in-the-middle attacker can send a Server Redirection PDU containing an oversized LB LOAD BALANCE INFO value to overflow the buffer with controlled content. This can lead to heap corruption or a denial of service before the authentication process is completed.

Recommendations Update to version 3.31.0 or later.