CVE-2026-91955 is a divide by zero and assertion failure in servers built on FreeRDP's server library before version 3.31.0. A remote client can crash the server process with a crafted handshake. NVD scores it High (7.5). Upgrade FreeRDP to 3.31.0.
What's affected
The GitHub advisory lists FreeRDP up to and including 3.30.0 as affected and 3.31.0 as patched. The NVD record says versions before 3.31.0. This is a server side defect: it affects software that uses FreeRDP's server API (libfreerdp), not the usual client that connects out to a remote desktop.
The weakness is CWE-369, divide by zero. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. VulnCheck lists a CVSS v4 score of 8.2.
The advisory notes that exposure depends on build and configuration. In a default CMake build the assertion paths are live, and no credentials are needed when the server offers TLS or standard RDP security without network level authentication. A server that requires NLA changes that picture.
How to check if you're exposed
First work out whether you ship or run anything built on FreeRDP's server API, such as the shadow server or an RDP gateway or proxy. Then check the library version through your package manager:
dpkg -l | grep -i freerdp
rpm -qa | grep -i freerdp
If you build from source, check the tag you built. Anything at 3.30.0 or earlier is in range. Many Linux distributions backport fixes without changing the upstream version number, so also read your distribution's security tracker for this CVE.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Upgrade FreeRDP to 3.31.0 or later, or install your distribution's patched package.
- Require network level authentication on any FreeRDP based server you expose, so unauthenticated clients cannot reach the capability exchange.
- Do not expose RDP servers directly to the internet. Put them behind a VPN or gateway.
- Run the server under a supervisor that restarts it, and alert on repeated crashes.
Why it matters
During the RDP handshake the client announces the size of its desktop. The advisory says FreeRDP stored those two numbers without a range check. Later, when the server builds its capability reply, it does tile arithmetic on the raw values inside assertions. A width of zero divides by zero, and a very large grid fails an assertion that aborts the process.
The pattern to remember is trusting a number the peer chose. Any value read off the wire needs a range check before it is used as a divisor or a size. The effect here is a crash, not code execution, and the KEV flag in the record is false.
Quick check
Does this affect the FreeRDP client?
The advisory says this is a server side defect in the capability writer, and separates it from client side codec issues.
Will NLA stop it?
The advisory says no credentials are needed when the server offers TLS or standard RDP security without NLA. Requiring NLA is a sensible hardening step, but upgrading is the fix.
Sources
Last reviewed: 18 October 2026.
