CVE-2026-91960

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description An integer overflow exists in the Stream EnsureRemainingCapacity() function within WinPR. A remote attacker acting as a malicious RD Gateway peer can send a WebSocket Ping frame containing a crafted 64-bit extended payload length. This triggers an integer wraparound, leading to a double free—a situation where the system attempts to free the same memory location twice—which causes the FreeRDP client to crash, resulting in a denial of service.

Recommendations Update FreeRDP to version 3.31.0 or later.