This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2026-91960 →
DEBIAN-CVE-2026-91960
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause de...
Original description
The description as published by the source.
FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers to cause denial of service. A malicious RD Gateway peer can send a WebSocket Ping frame with a crafted 64-bit extended payload length to trigger integer wraparound, resulting in a double free that crashes the FreeRDP client during connection.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:14
freerdp3
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0+dfsg-1"}]}]
References
- advisory security-tracker.debian.org