CVE-2026-91950
FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Passive
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
CVE-2026-91950- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2026-78807
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
EUVD-2026-78807- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-858j-6g95-r29w
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet...
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
GHSA-858j-6g95-r29w- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
CVE-2026-91950- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSV
FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
CVE-2026-91950- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-91950
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
DEBIAN-CVE-2026-91950- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVRHSA-2026:75570
Red Hat Security Advisory: freerdp security update
- Record
RHSA-2026:75570- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRLSA-2026:75570
Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
-
FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)
-
FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
-
FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
-
FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)
-
FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
-
FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
-
FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)
-
FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
-
FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)
-
FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)
-
FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2026:75570- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-91950
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Record
UBUNTU-CVE-2026-91950- CVSS 4.0
- 7.1 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2026:75570 No score
Important: freerdp security update
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
- FreeRDP: freerdp-proxy: FreeRDP: Information disclosure via uninitialized heap memory in Save Session Info PDU (CVE-2026-85089)
- FreeRDP: FreeRDP: Denial of Service via crafted Surface Bits command (CVE-2026-91954)
- FreeRDP: FreeRDP: Remote code execution via heap buffer overflow in Server Redirection PDU (CVE-2026-91964)
- FreeRDP: FreeRDP: Information Disclosure via RDPGFX ResetGraphics PDU (CVE-2026-91946)
- FreeRDP: FreeRDP: Denial of Service via out-of-bounds read in URBDRC channel (CVE-2026-91956)
- FreeRDP: FreeRDP: Remote code execution via uninitialized heap memory disclosure (CVE-2026-91963)
- FreeRDP: FreeRDP: Use-after-free vulnerability in DRDYNVC parser leads to memory corruption (CVE-2026-91947)
- FreeRDP: FreeRDP: Denial of Service due to buffer over-read in RPC gateway (CVE-2026-91959)
- FreeRDP: FreeRDP: Out-of-bounds read leads to denial of service or information disclosure (CVE-2026-91950)
- FreeRDP: FreeRDP: Denial of Service via integer overflow and double free in WinPR (CVE-2026-91960)
- FreeRDP: FreeRDP: Heap buffer overflow via oversized LB_LOAD_BALANCE_INFO routing token can lead to heap corruption. (CVE-2026-91953)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2026:75570- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freerdpAlmaLinux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-develAlmaLinux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-libsAlmaLinux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-serverAlmaLinux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
libwinprAlmaLinux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
libwinpr-develAlmaLinux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp2Debian:12 |
All versions, plus listed versions 2.10.0+dfsg1-12.10.0+dfsg1-1.12.11.2+dfsg1-12.11.2+dfsg1-1.1~exp12.11.2+dfsg1-1.1~exp2 Show 8 moreShow less2.11.5+dfsg1-12.11.7+dfsg1-12.11.7+dfsg1-22.11.7+dfsg1-32.11.7+dfsg1-42.11.7+dfsg1-52.11.7+dfsg1-62.11.7+dfsg1-6~deb12u1 |
None known |
freerdp3Debian:13 |
All versions, plus listed versions 3.15.0+dfsg-2.13.15.0+dfsg-2.1+deb13u13.15.0+dfsg-2.1+deb13u23.15.0+dfsg-2.1+deb13u33.16.0+dfsg-1 Show 42 moreShow less3.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-13.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+13.31.0+dfsg-13.31.1+dfsg-13.31.1+dfsg-1~bpo13+13.32.0+dfsg-1 |
None known |
freerdp3Debian:14 |
before 3.31.0+dfsg-1, plus listed versions 3.15.0+dfsg-2.13.16.0+dfsg-13.16.0+dfsg-23.17.0+dfsg-13.17.1+dfsg-1 Show 35 moreShow less3.17.1+dfsg-23.17.2+dfsg-13.17.2+dfsg-23.17.2+dfsg-33.18.0+dfsg-13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-13.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.22.0+dfsg-1~bpo13+03.22.0+dfsg-1~bpo13+13.22.0+dfsg-33.23.0+dfsg-13.23.0+dfsg-1~bpo13+13.24.0+dfsg-13.24.0+dfsg-23.24.1+dfsg-13.24.2+dfsg-13.24.2+dfsg-1~bpo13+13.25.0+dfsg-13.25.0+dfsg-23.25.0+dfsg-33.25.0+dfsg-43.25.0+dfsg-53.26.0+dfsg-13.26.0+dfsg-1~bpo13+13.27.0+dfsg-13.27.1+dfsg-13.28.0+dfsg-13.28.0+dfsg-23.29.0+dfsg-13.30.0+dfsg-13.30.0+dfsg-1~bpo13+1 |
3.31.0+dfsg-1 |
freerdpRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
Show 19 moreShow less
| Package | Affected | Fixed |
|---|---|---|
freerdp-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-debugsourceRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-libsRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-libs-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-server-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
libwinprRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
libwinpr-debuginfoRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-develRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdp-serverRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
libwinpr-develRed Hat:enterprise_linux:10.2 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdpRocky Linux:10 From an advisory covering 11 CVEs |
before 2:3.10.3-12.el10_2.14 | 2:3.10.3-12.el10_2.14 |
freerdpUbuntu:16.04:LTS |
All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-5ubuntu11.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.21.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.31.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4 |
None known |
freerdp2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 2.0.0~git20170725.1.1648deb+dfsg1-12.0.0~git20170725.1.1648deb+dfsg1-52.0.0~git20170725.1.1648deb+dfsg1-5ubuntu12.0.0~git20170725.1.1648deb+dfsg1-5ubuntu22.0.0~git20170725.1.1648deb+dfsg1-6 Show 14 moreShow less2.0.0~git20170725.1.1648deb+dfsg1-6build12.0.0~git20170725.1.1648deb+dfsg1-72.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.12.1.1+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.12.2.0+dfsg1-0ubuntu0.18.04.22.2.0+dfsg1-0ubuntu0.18.04.32.2.0+dfsg1-0ubuntu0.18.04.42.2.0+dfsg1-0ubuntu0.18.04.4+esm12.2.0+dfsg1-0ubuntu0.18.04.4+esm22.2.0+dfsg1-0ubuntu0.18.04.4+esm32.2.0+dfsg1-0ubuntu0.18.04.4+esm42.2.0+dfsg1-0ubuntu0.18.04.4+esm52.2.0+dfsg1-0ubuntu0.18.04.4+esm6 |
None known |
freerdpUbuntu:18.04:LTS |
All versions, plus listed versions 1.1.0~git20140921.1.440916e+dfsg1-15ubuntu11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.11.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2 |
None known |
freerdp2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.0.0~git20190204.1.2693389a+dfsg1-12.0.0~git20190204.1.2693389a+dfsg1-22.0.0~git20190204.1.2693389a+dfsg1-2build12.0.0~git20190204.1.2693389a+dfsg1-2build22.1.1+dfsg1-0ubuntu0.20.04.1 Show 12 moreShow less2.2.0+dfsg1-0ubuntu0.20.04.12.2.0+dfsg1-0ubuntu0.20.04.22.2.0+dfsg1-0ubuntu0.20.04.32.2.0+dfsg1-0ubuntu0.20.04.42.2.0+dfsg1-0ubuntu0.20.04.52.2.0+dfsg1-0ubuntu0.20.04.62.6.1+dfsg1-0ubuntu0.20.04.12.6.1+dfsg1-0ubuntu0.20.04.22.6.1+dfsg1-0ubuntu0.20.04.2+esm12.6.1+dfsg1-0ubuntu0.20.04.2+esm22.6.1+dfsg1-0ubuntu0.20.04.2+esm32.6.1+dfsg1-0ubuntu0.20.04.2+esm4 |
None known |
freerdp2Ubuntu:22.04:LTS |
All versions, plus listed versions 2.3.0+dfsg1-2build12.3.0+dfsg1-2ubuntu12.3.0+dfsg1-2ubuntu22.4.1+dfsg1-12.4.1+dfsg1-1ubuntu1 Show 18 moreShow less2.4.1+dfsg1-1ubuntu22.5.0+dfsg1-12.6.0+dfsg1-12.6.1+dfsg1-12.6.1+dfsg1-32.6.1+dfsg1-3ubuntu12.6.1+dfsg1-3ubuntu22.6.1+dfsg1-3ubuntu2.12.6.1+dfsg1-3ubuntu2.22.6.1+dfsg1-3ubuntu2.32.6.1+dfsg1-3ubuntu2.42.6.1+dfsg1-3ubuntu2.52.6.1+dfsg1-3ubuntu2.62.6.1+dfsg1-3ubuntu2.72.6.1+dfsg1-3ubuntu2.82.6.1+dfsg1-3ubuntu2.92.6.1+dfsg1-3ubuntu2.102.6.1+dfsg1-3ubuntu2.11 |
None known |
freerdp3Ubuntu:24.04:LTS |
before 3.31.0+dfsg-0ubuntu0.24.04.1, plus listed versions 3.4.0+dfsg1-0ubuntu23.4.0+dfsg1-0ubuntu33.4.0+dfsg1-0ubuntu43.5.0+dfsg1-0ubuntu13.5.1+dfsg1-0ubuntu1 Show 7 moreShow less3.5.1+dfsg1-0ubuntu1.13.5.1+dfsg1-0ubuntu1.23.5.1+dfsg1-0ubuntu1.43.5.1+dfsg1-0ubuntu1.53.5.1+dfsg1-0ubuntu1.63.30.0+dfsg-0ubuntu0.24.04.13.30.0+dfsg-0ubuntu0.24.04.2 |
3.31.0+dfsg-0ubuntu0.24.04.1 |
freerdp2Ubuntu:Pro:24.04:LTS |
All versions, plus listed versions 2.10.0+dfsg1-1.1ubuntu12.11.2+dfsg1-12.11.2+dfsg1-1build12.11.2+dfsg1-1build32.11.5+dfsg1-1build1 Show 7 moreShow less2.11.5+dfsg1-1build22.11.5+dfsg1-1ubuntu0.1~esm12.11.5+dfsg1-1ubuntu0.1~esm22.11.5+dfsg1-1ubuntu0.1~esm32.11.5+dfsg1-1ubuntu0.1~esm42.11.5+dfsg1-1ubuntu0.1~esm52.11.5+dfsg1-1ubuntu0.1~esm6 |
None known |
freerdp3Ubuntu:26.04:LTS |
before 3.31.0+dfsg-0ubuntu0.26.04.1, plus listed versions 3.16.0+dfsg-23.18.0+dfsg-1ubuntu13.19.0+dfsg-13.19.1+dfsg-13.20.0+dfsg-1 Show 8 moreShow less3.20.2+dfsg-13.21.0+dfsg-13.22.0+dfsg-13.24.1+dfsg-1ubuntu13.24.2+dfsg-1ubuntu13.24.2+dfsg-1ubuntu1.13.30.0+dfsg-0ubuntu0.26.04.13.30.0+dfsg-0ubuntu0.26.04.2 |
3.31.0+dfsg-0ubuntu0.26.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-91950 is a high vulnerability (CVSS 7.1) in Freerdp, published September 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in freerdp3 3.31.0+dfsg-1.
References
github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5gr-hmqp-pwj4
vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-uint32-wraparound
nvd.nist.gov/vuln/detail/CVE-2026-91950
access.redhat.com/errata/RHSA-2026:75570
Show 85 moreShow less
bugzilla.redhat.com/2527811
errata.almalinux.org/10/ALSA-2026-75570.html
security-tracker.debian.org/tracker/CVE-2026-91950
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_75570.json
cve.org/CVERecord?id=CVE-2026-85089
errata.rockylinux.org/RLSA-2026:75570
ubuntu.com/security/CVE-2026-91950