Description

FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the server. Attackers can send crafted RDP packets with zero or oversized dimensions to trigger division-by-zero or assertion failures in multifragment update capability calculations, terminating the server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-15T16:17:49.963Z",
  "pubdate": "2026-09-15T16:17:49.963Z",
  "executiveSummary": "FreeRDP versions prior to 3.31.0 contain a critical vulnerability in the GCC (Generic Conference Control) negotiation phase of the RDP protocol.\nThe vulnerability is classified as an improper input validation flaw, which allows unauthenticated remote attackers to trigger a process crash.\nBy supplying malformed DesktopWidth and DesktopHeight parameters, an attacker can induce division-by-zero errors or assertion failures within the multifragment update capability calculations.\nThe successful exploitation of this flaw results in a Denial of Service (DoS) condition, terminating the RDP server process.\nThis vulnerability is particularly concerning due to its remote exploitability and the absence of required authentication, making it an attractive target for service disruption attacks.\nSystem administrators are strongly advised to update affected FreeRDP instances to version 3.31.0 or later to mitigate the risk of forced service termination.",
  "technicalDetails": "The vulnerability resides in the FreeRDP handling of client-supplied dimensions during the initial RDP connection sequence, specifically within the GCC negotiation phase.\nDuring this phase, the client communicates its desired display parameters—DesktopWidth and DesktopHeight—to the server. FreeRDP fails to perform adequate bounds checking or sanitization on these input values before utilizing them in downstream calculations.\nThe root cause is the improper handling of zero or excessively large dimension values. When these values are passed to the multifragment update capability component, they trigger mathematical anomalies.\nSpecifically, when the server attempts to calculate memory offsets or divide segments for multifragment updates, the zero values induce a division-by-zero fault, while out-of-range dimensions trigger assertion failures within the internal update logic.\nThe attack flow begins with an attacker initiating a standard RDP connection request. Prior to the completion of the handshake, the attacker injects crafted RDP packets containing malicious dimension values into the capability negotiation stream.\nBecause these calculations occur during the early stages of the RDP handshake, the attacker does not need to possess valid user credentials or achieve authenticated session status.\nOnce the server processes the malformed values, the resulting software exception—either a CPU-level division-by-zero error or a logic-level assertion failure—leads to the immediate and abrupt termination of the RDP server process.\nThis vulnerability is present in versions of FreeRDP prior to 3.31.0. The impact is limited to a service-level denial of service, as there is no current evidence suggesting that this specific flaw facilitates remote code execution or unauthorized access to the underlying host memory beyond causing the crash.\nDue to the nature of the RDP protocol, the service is exposed over the network, typically on TCP port 3389, allowing attackers to target any reachable FreeRDP server without requiring complex pre-conditions beyond network visibility.\nThe lack of input validation at the protocol negotiation layer allows the malicious payload to bypass generic state-machine protections, directly interacting with the vulnerable capability negotiation functions."
}