CVE-2026-91954

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

7.1 HighFix available

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Passive

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.39%Unchanged since Sep 16, 2026

What each source reports

CVE List Score used 7.1

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

Record: CVE-2026-91954
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

EUVDEUVD-2026-78630 7.1

Record: EUVD-2026-78630
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-32wp-qph9-89pm 7.1

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when...

Record: GHSA-32wp-qph9-89pm
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

NVD 7.1

Record: CVE-2026-91954
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness: CWE-476
Updated: 2026-11-02

OSV 7.1

FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

Record: CVE-2026-91954
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-476
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-91954 7.1

Record: DEBIAN-CVE-2026-91954
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-02

Show 10 moreShow less

OSVRHSA-2026:75570 8.8

Red Hat Security Advisory: freerdp security update

Record: RHSA-2026:75570
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76747 8.8

Red Hat Security Advisory: freerdp security update

Record: RHSA-2026:76747
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRHSA-2026:76755 8.8

Red Hat Security Advisory: freerdp security update

Record: RHSA-2026:76755
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:75570 8.8

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)
FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)
FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:75570
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:76747 8.8

Important: freerdp security update

Security Fix(es):

FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:76747
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVRLSA-2026:76755 8.8

Important: freerdp security update

Security Fix(es):

FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: RLSA-2026:76755
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-91954 7.1

Record: UBUNTU-CVE-2026-91954
CVSS 4.0: 7.1 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 6.5 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVALSA-2026:75570 No score

Important: freerdp security update

Security Fix(es):

FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)
FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)
FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:75570
Updated: 2026-11-02

OSVALSA-2026:76747 No score

Important: freerdp security update

Security Fix(es):

FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:76747
Updated: 2026-11-02

OSVALSA-2026:76755 No score

Important: freerdp security update

Security Fix(es):

FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Record: ALSA-2026:76755
Updated: 2026-11-02

Affected products

freerdp

Affected packages

Affected packages
Package	Affected	Fixed
`freerdp` AlmaLinux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-devel` AlmaLinux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-libs` AlmaLinux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-server` AlmaLinux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`libwinpr` AlmaLinux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`libwinpr-devel` AlmaLinux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp` AlmaLinux:8 From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-devel` AlmaLinux:8 From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-libs` AlmaLinux:8 From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`libwinpr` AlmaLinux:8 From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10

Show 57 moreShow less

Affected packages
Package	Affected	Fixed
`libwinpr-devel` AlmaLinux:8 From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp` AlmaLinux:9 From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-devel` AlmaLinux:9 From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-libs` AlmaLinux:9 From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`libwinpr` AlmaLinux:9 From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`libwinpr-devel` AlmaLinux:9 From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp2` Debian:12	All versions, plus listed versions 2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2 Show 8 moreShow less 2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1	None known
`freerdp3` Debian:13	All versions, plus listed versions 3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1 Show 42 moreShow less 3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-1	None known
`freerdp3` Debian:14	before 3.31.0+dfsg-1, plus listed versions 3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1 Show 35 moreShow less 3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+1	3.31.0+dfsg-1
`freerdp` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-debugsource` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-libs` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-libs-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-server-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`libwinpr` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`libwinpr-debuginfo` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-devel` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp-server` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`libwinpr-devel` Red Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-debugsource` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-libs` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-libs-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`libwinpr` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`libwinpr-debuginfo` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`libwinpr-devel` Red Hat:enterprise_linux:8::appstream From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-debugsource` Red Hat:enterprise_linux:8::crb From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-devel` Red Hat:enterprise_linux:8::crb From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp-libs-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`libwinpr-debuginfo` Red Hat:enterprise_linux:8::crb From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-debugsource` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-libs` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-libs-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`libwinpr` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`libwinpr-debuginfo` Red Hat:enterprise_linux:9::appstream From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-debugsource` Red Hat:enterprise_linux:9::crb From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-devel` Red Hat:enterprise_linux:9::crb From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp-libs-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`libwinpr-debuginfo` Red Hat:enterprise_linux:9::crb From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`libwinpr-devel` Red Hat:enterprise_linux:9::crb From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp` Rocky Linux:10 From an advisory covering 11 CVEs	before 2:3.10.3-12.el10_2.14	2:3.10.3-12.el10_2.14
`freerdp` Rocky Linux:8 From an advisory covering 6 CVEs	before 2:2.11.7-14.el8_10	2:2.11.7-14.el8_10
`freerdp` Rocky Linux:9 From an advisory covering 6 CVEs	before 2:2.11.7-7.el9_8.8	2:2.11.7-7.el9_8.8
`freerdp` Ubuntu:16.04:LTS	All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4	None known
`freerdp2` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6 Show 14 moreShow less 2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6	None known
`freerdp` Ubuntu:18.04:LTS	All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2	None known
`freerdp2` Ubuntu:Pro:20.04:LTS	All versions, plus listed versions 2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1 Show 12 moreShow less 2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4	None known
`freerdp2` Ubuntu:22.04:LTS	All versions, plus listed versions 2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1 Show 18 moreShow less 2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11	None known
`freerdp3` Ubuntu:24.04:LTS	before 3.31.0+dfsg-0ubuntu0.24.04.1, plus listed versions 3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1 Show 7 moreShow less 3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.63.30.0+dfsg-0ubuntu0.24.04.13.30.0+dfsg-0ubuntu0.24.04.2	3.31.0+dfsg-0ubuntu0.24.04.1
`freerdp2` Ubuntu:Pro:24.04:LTS	All versions, plus listed versions 2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1 Show 7 moreShow less 2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6	None known
`freerdp3` Ubuntu:26.04:LTS	before 3.31.0+dfsg-0ubuntu0.26.04.1, plus listed versions 3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1 Show 8 moreShow less 3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.13.30.0+dfsg-0ubuntu0.26.04.13.30.0+dfsg-0ubuntu0.26.04.2	3.31.0+dfsg-0ubuntu0.26.04.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-91954 is a high vulnerability (CVSS 7.1) in Freerdp, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in freerdp3 3.31.0+dfsg-1.

References

Show 93 moreShow less