CVE-2026-91948 – FreeRDP
“One unauthenticated handshake slips past policy, and one rogue server turns a routine connection into heap corruption. Every unpatched FreeRDP endpoint is an open door.”
FreeRDP 3.31.0 fixes four vulnerabilities that affect both FreeRDP servers and clients. CVE-2026-91949 has a CVSS score of 9.3, Critical severity. It is a protocol negotiation bypass that lets unauthenticated attackers open RDSTLS connections even when server policy disables them. That gets around the server's pre-authentication transport restrictions. CVE-2026-91964 has a CVSS score of 8.8, High severity. It is a heap-based buffer overflow in the client: a malicious RDP server can send an oversized LoadBalanceInfo field in a Server Redirection message, which crashes the client and can lead to code execution.
CVE-2026-91948 has a CVSS score of 7.5, High severity. It is an out-of-bounds write in server-side static virtual channel handling that lets authenticated clients corrupt heap memory and possibly execute code. CVE-2026-91947 has a CVSS score of 7.5, High severity. It is a use-after-free race in the server's DRDYNVC parser that authenticated clients can trigger for elevation of privilege. Upgrade all FreeRDP deployments to version 3.31.0.
Key Details
- Attack Vector
- Network
- Attack Complexity
- High
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-191