CVE-2026-91952

Name	CVE-2026-91952
Description	FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pool_decode_rect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode path to loop indefinitely, consuming CPU and preventing normal client operation.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
freerdp2 (PTS)	bookworm	2.11.7+dfsg1-6~deb12u1	fixed
freerdp3 (PTS)	trixie	3.15.0+dfsg-2.1+deb13u3	vulnerable
	forky, sid	3.32.1+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
freerdp2	source	(unstable)	(not affected)
freerdp3	source	(unstable)	3.31.0+dfsg-1

- freerdp2 <not-affected> (Only affects 3.11 and later)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m85m-3qxv-63h5