CVE-2026-91953 FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO

What is CVE-2026-91953?

CVE-2026-91953 is a high-severity memory corruption vulnerability in Freerdp Freerdp, published on 15 Sep 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in nego_send_negotiation_request() that fails to validate the LB_LOAD_BALANCE_INFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LB_LOAD_BALANCE_INFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.

Weakness: CWE-120

Which versions are affected by CVE-2026-91953?

It affects 1 product.

Products include Freerdp Freerdp.

How do I fix CVE-2026-91953?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-91953 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-91953 exists.

Other vulnerabilities in Freerdp Freerdp

• CVE-2021-37594 Other in n/a Critical 9.8
• CVE-2021-37595 Other in n/a Critical 9.8
• CVE-2026-67305 FreeRDP Windows Client before 3.29.0 Heap Buffer Overflow via Cliprdr Critical 9.4
• CVE-2026-66402 FreeRDP before 3.29.0 TLS Certificate Identity Validation Bypass Critical 9.3
• CVE-2026-67289 FreeRDP before 3.29.0 HTTP Proxy Request Injection via Redirection Critical 9.3

All Freerdp Freerdp vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2026-91953, GHSA-5mm3-24pm-34qv, GHSA-r9pv-ffph-6gg6, UBUNTU-CVE-2026-91953.