CVE-2026-91964

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description A heap-based buffer overflow occurs in the nego send negotiation request() function when processing Server Redirection PDU (Protocol Data Unit) messages. A malicious RDP server can trigger this issue by sending an arbitrary-length LoadBalanceInfo field that is written to a fixed 512-byte buffer without proper validation. This can lead to client crashes or potential remote code execution if combined with memory disclosure.

Recommendations Update to version 3.31.0 or later.