Threat video1:00
CVE-2026-91964 FreeRDP Client RCE Chain: Detection & IOCs
Quarkslab chained FreeRDP heap bugs into lab RCE via a hostile RDP server, fixed in 3.31.0. It has 9 detection rules (one free in Splunk SPL) and 10 IOCs.
Read the full threat intel for CVE-2026-91964 FreeRDP Client RCE Chain: Detection & IOCs →
Chapters
- 0:00The hookAI found FreeRDP flaws; researchers chained two.
- 0:04The storyBoth flaws are fixed in FreeRDP.
- 0:11Attack pathQuarkslab's agentic harness found flaws in FreeRDP.
- 0:26AttributionNo threat actor: this was defensive research.
- 0:31Indicators of compromise7 indicators to hunt: 1 hash, 2 file names and 3 package names, and more.
- 0:38MITRE ATT&CK techniques7 ATT&CK techniques, from resource development to impact.
- 0:43Remediation9 remediation steps are listed, 3 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00AI found FreeRDP flaws; researchers chained two.
0:05Both flaws are fixed in FreeRDP.
0:07Researchers reproduced the chain in a lab.
0:11Quarkslab's agentic harness found flaws in FreeRDP.
0:15The chain paired a heap overflow with a leak.
0:18A lab server forced a reconnect.
0:20Alone it crashes the client; chained, it reached RCE.
0:27No threat actor: this was defensive research.
0:317 indicators to hunt: 1 hash, 2 file names and 3 package names, and more.
0:387 ATT&CK techniques, from resource development to impact.
0:439 remediation steps are listed, 3 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.