CVE-2026-91964High· 8.8▾ TwilightFreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 48.4 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.5%
Last analysed / modified upstream
0.5% → 0.6%
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55194Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-55193High· 8.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-63633Critical· 9.8FreeRDP is a free implementation of the Remote Desktop Protocol
CVE-2026-114045High· 8.8FreeRDP before 3.32.1 Heap Buffer Overflow via rdpsnd_server_select_format
CVE-2026-111379High· 7.3FreeRDP before 3.32.0 Heap Buffer Overflow via persistent_cache_read_entry_v3
CVE-2026-111381High· 7.3FreeRDP before 3.32.0 Heap Buffer Overflow via Persistent Cache v2 Parser