CVE-2026-91952

EUVD-2026-78809
FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode path to loop indefinitely, consuming CPU and preventing normal client operation.
Infinite Loop
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 33.35%
Affected Products (NVD)
VendorProductVersion
freerdpfreerdp
3.11.0 <
𝑥
< 3.31.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
freerdp2
bookworm
2.11.7+dfsg1-6~deb12u1
fixed
freerdp3
forky
3.32.2+dfsg-1
fixed
sid
3.32.2+dfsg-1
fixed
trixie
vulnerable
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
freerdp
bionic
needs-triage
jammy
dne
noble
dne
resolute
dne
xenial
needs-triage
freerdp2
bionic
needs-triage
focal
needs-triage
jammy
needs-triage
noble
needs-triage
resolute
dne
freerdp3
jammy
dne
noble
Fixed 3.31.0+dfsg-0ubuntu0.24.04.1
released
resolute
Fixed 3.31.0+dfsg-0ubuntu0.26.04.1
released
Common Weakness Enumeration
References
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m85m-3qxv-63h5
https://www.vulncheck.com/advisories/freerdp-before-3.31.0-denial-of-service-via-pool-decode-rect
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m85m-3qxv-63h5