Description

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-09-15T16:17:52.480Z",
  "pubdate": "2026-09-15T16:17:52.480Z",
  "executiveSummary": "A critical heap-based buffer overflow vulnerability exists in FreeRDP versions prior to 3.31.0 within the nego_send_negotiation_request function.\nThe vulnerability occurs due to improper bounds checking when processing Server Redirection PDU messages containing attacker-controlled LoadBalanceInfo fields.\nAn unauthenticated, malicious RDP server can exploit this flaw by providing an arbitrarily large LoadBalanceInfo field, which is subsequently written to a fixed 512-byte buffer.\nSuccessful exploitation allows for client-side crashes, causing a denial-of-service condition, or potential arbitrary code execution if the vulnerability is paired with memory disclosure techniques to bypass exploit mitigations.\nThe vulnerability represents a significant risk to RDP clients, as the exploitation is triggered automatically upon connection to a malicious server, requiring no prior user interaction beyond initiating the RDP session.\nThe impact is severe given the ubiquity of FreeRDP in various remote access implementations, potentially leading to full compromise of the affected client machine.",
  "technicalDetails": "The vulnerability resides in the nego_send_negotiation_request function within the FreeRDP codebase, specifically during the handling of RDP negotiation packets.\nThe root cause is a lack of input validation for the LoadBalanceInfo field contained within a Server Redirection PDU. The application allocates a stack or heap buffer of a fixed size—512 bytes—to accommodate this field during the RDP negotiation handshake.\nWhen a malicious server sends a crafted Server Redirection PDU, the LoadBalanceInfo field can be defined with a length exceeding the capacity of the target destination buffer. Because the application fails to perform a length check against the 512-byte limit, the memory copy operation (such as memcpy or a similar buffer-filling routine) proceeds beyond the bounds of the destination buffer.\nThis overflow allows an attacker to overwrite adjacent memory structures on the heap, corrupting metadata or neighboring objects. By precisely controlling the data sent in the LoadBalanceInfo field, an attacker can overwrite function pointers, heap control structures, or other sensitive data stored in the memory proximity of the buffer.\nExploitation typically follows a specific flow: The client initiates an RDP connection to the malicious server. The server responds with a Server Redirection PDU including a malformed, oversized LoadBalanceInfo string. The client's nego_send_negotiation_request function processes this input, triggering the heap overflow. If memory layout is predictable or can be groomed, the attacker can hijack control flow to execute arbitrary code with the privileges of the user running the FreeRDP process.\nWhile the primary vector is a denial-of-service (crashing the client), the heap-based nature of the overflow makes it a candidate for sophisticated exploit chains, especially when combined with separate information leaks to bypass Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).\nAffected versions include all FreeRDP releases prior to 3.31.0. The vulnerability is exploitable via the network without user authentication, effectively targeting the client-side parsing logic immediately upon the initial protocol negotiation phase."
}