CVE-2026-91960 — FreeRDP before 3.31.0 Integer Overflow Double Free
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A maliciou…
Published: 2026-09-15 · CVSS: 7.1 · CVSS 4.0
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer wraparound, resulting in a double free that crashes the FreeRDP client during connection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7