CVE-2026-27951
Published: 25 February 2026
Summary
CVE-2026-27951 is a medium-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Freerdp Freerdp. Its CVSS base score is 5.3 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-27951 is a vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol, affecting versions prior to 3.23.0. The issue lies in the Stream_EnsureCapacity function, which can enter an endless blocking loop due to an integer overflow or wraparound (CWE-190). This flaw impacts all client and server implementations that incorporate FreeRDP.
A remote attacker requires no privileges or user interaction and can exploit the vulnerability over the network with low attack complexity, as reflected in its CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Exploitation causes a denial of service through the blocking loop, but is practically limited to 32-bit systems where available physical memory is greater than or equal to SIZE_MAX.
FreeRDP version 3.23.0 includes a patch addressing the vulnerability, with no known workarounds available. Mitigation details are documented in the GitHub security advisory at GHSA-qcfc-ghxr-h927 and the fixing commit at 118afc0b954ba9d5632b7836ad24e454555ed113.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8755
Vulnerability details
FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, the function `Stream_EnsureCapacity` can create an endless blocking loop. This may affect all client and server implementations using `FreeRDP`. For practical exploitation this will only work…
more
on 32bit systems where the available physical memory is `>= SIZE_MAX`. Version 3.23.0 contains a patch. No known workarounds are available.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Integer overflow triggers infinite loop DoS in FreeRDP (client/server) over unauthenticated network access, directly matching application exploitation for endpoint availability impact.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces validation of untrusted RDP stream data to block the integer wraparound that triggers the endless loop in Stream_EnsureCapacity.
Requires prompt application of the vendor patch (v3.23.0) that corrects the integer-overflow flaw in the affected FreeRDP function.
Provides denial-of-service protection mechanisms that can throttle or isolate the resource-exhaustion effect caused by the blocking loop on vulnerable 32-bit deployments.