CVE-2026-27951
Published: 25 February 2026
Summary
CVE-2026-27951 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Freerdp Freerdp. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Threat & Defense at a Glance
Threat & Defense Details
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow triggers infinite loop DoS in FreeRDP (client/server) over unauthenticated network access, directly matching application exploitation for endpoint availability impact.
NVD Description
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work…
more
on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
Deeper analysisAI
CVE-2026-27951 is a vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.23.0. The issue lies in the Stream_EnsureCapacity function, which can enter an endless blocking loop due to an integer overflow or wraparound (CWE-190). This flaw impacts all client and server implementations that incorporate FreeRDP.
A remote attacker requires no privileges or user interaction and can exploit the vulnerability over the network with low attack complexity, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation causes a denial of service through the blocking loop, but is practically limited to 32-bit systems where available physical memory is greater than or equal to SIZE_MAX.
FreeRDP version 3.23.0 includes a patch addressing the vulnerability, with no known workarounds available. Mitigation details are documented in the GitHub security advisory at GHSA-qcfc-ghxr-h927 and the fixing commit at 118afc0b954ba9d5632b7836ad24e454555ed113.
Details
- CWE(s)