{"id":"CVE-2026-91957","aliases":["CLSA-2026-1791568721","CLSA-2026-1791569293","DEBIAN-CVE-2026-91957","EUVD-2026-78633","GHSA-h5f5-2qh4-2xjm","GHSA-j5mq-3349-gwmm","UBUNTU-CVE-2026-91957"],"status":"published","title":"FreeRDP before 3.31.0 Use-After-Free via smartcard worker","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","severity":{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00366,"percentile":0.30831,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2026-09-15T15:18:12Z","modified":"2026-10-28T02:30:22Z","fixes":[{"ecosystem":"Debian:14","package":"freerdp3","fixed_in":["3.31.0+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","fixed_in":["3.31.0+dfsg-0ubuntu0.24.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","fixed_in":["3.31.0+dfsg-0ubuntu0.26.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:CentOS:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"freerdp-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"libwinpr-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.1-5.0.9.el7_9.tuxcare.els5"}]}],"bundled":6},{"source":"osv","ecosystem":"Debian:12","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1","2.10.0+dfsg1-1.1","2.11.2+dfsg1-1","2.11.2+dfsg1-1.1~exp1","2.11.2+dfsg1-1.1~exp2","2.11.5+dfsg1-1","2.11.7+dfsg1-1","2.11.7+dfsg1-2","2.11.7+dfsg1-3","2.11.7+dfsg1-4","2.11.7+dfsg1-5","2.11.7+dfsg1-6","2.11.7+dfsg1-6~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.15.0+dfsg-2.1","3.15.0+dfsg-2.1+deb13u1","3.15.0+dfsg-2.1+deb13u2","3.15.0+dfsg-2.1+deb13u3","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1","3.31.0+dfsg-1","3.31.1+dfsg-1","3.31.1+dfsg-1~bpo13+1","3.32.0+dfsg-1"]},{"source":"osv","ecosystem":"Debian:14","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0+dfsg-1"}]}],"versions":["3.15.0+dfsg-2.1","3.16.0+dfsg-1","3.16.0+dfsg-2","3.17.0+dfsg-1","3.17.1+dfsg-1","3.17.1+dfsg-2","3.17.2+dfsg-1","3.17.2+dfsg-2","3.17.2+dfsg-3","3.18.0+dfsg-1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.22.0+dfsg-1~bpo13+0","3.22.0+dfsg-1~bpo13+1","3.22.0+dfsg-3","3.23.0+dfsg-1","3.23.0+dfsg-1~bpo13+1","3.24.0+dfsg-1","3.24.0+dfsg-2","3.24.1+dfsg-1","3.24.2+dfsg-1","3.24.2+dfsg-1~bpo13+1","3.25.0+dfsg-1","3.25.0+dfsg-2","3.25.0+dfsg-3","3.25.0+dfsg-4","3.25.0+dfsg-5","3.26.0+dfsg-1","3.26.0+dfsg-1~bpo13+1","3.27.0+dfsg-1","3.27.1+dfsg-1","3.28.0+dfsg-1","3.28.0+dfsg-2","3.29.0+dfsg-1","3.30.0+dfsg-1","3.30.0+dfsg-1~bpo13+1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.2","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.3","1.1.0~git20140921.1.440916e+dfsg1-5ubuntu1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20170725.1.1648deb+dfsg1-1","2.0.0~git20170725.1.1648deb+dfsg1-5","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu1","2.0.0~git20170725.1.1648deb+dfsg1-5ubuntu2","2.0.0~git20170725.1.1648deb+dfsg1-6","2.0.0~git20170725.1.1648deb+dfsg1-6build1","2.0.0~git20170725.1.1648deb+dfsg1-7","2.0.0~git20170725.1.1648deb+dfsg1-7ubuntu0.1","2.1.1+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.1","2.2.0+dfsg1-0ubuntu0.18.04.2","2.2.0+dfsg1-0ubuntu0.18.04.3","2.2.0+dfsg1-0ubuntu0.18.04.4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm1","2.2.0+dfsg1-0ubuntu0.18.04.4+esm2","2.2.0+dfsg1-0ubuntu0.18.04.4+esm3","2.2.0+dfsg1-0ubuntu0.18.04.4+esm4","2.2.0+dfsg1-0ubuntu0.18.04.4+esm5","2.2.0+dfsg1-0ubuntu0.18.04.4+esm6"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"freerdp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.1","1.1.0~git20140921.1.440916e+dfsg1-15ubuntu1.18.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0~git20190204.1.2693389a+dfsg1-1","2.0.0~git20190204.1.2693389a+dfsg1-2","2.0.0~git20190204.1.2693389a+dfsg1-2build1","2.0.0~git20190204.1.2693389a+dfsg1-2build2","2.1.1+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.1","2.2.0+dfsg1-0ubuntu0.20.04.2","2.2.0+dfsg1-0ubuntu0.20.04.3","2.2.0+dfsg1-0ubuntu0.20.04.4","2.2.0+dfsg1-0ubuntu0.20.04.5","2.2.0+dfsg1-0ubuntu0.20.04.6","2.6.1+dfsg1-0ubuntu0.20.04.1","2.6.1+dfsg1-0ubuntu0.20.04.2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm1","2.6.1+dfsg1-0ubuntu0.20.04.2+esm2","2.6.1+dfsg1-0ubuntu0.20.04.2+esm3","2.6.1+dfsg1-0ubuntu0.20.04.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.0+dfsg1-2build1","2.3.0+dfsg1-2ubuntu1","2.3.0+dfsg1-2ubuntu2","2.4.1+dfsg1-1","2.4.1+dfsg1-1ubuntu1","2.4.1+dfsg1-1ubuntu2","2.5.0+dfsg1-1","2.6.0+dfsg1-1","2.6.1+dfsg1-1","2.6.1+dfsg1-3","2.6.1+dfsg1-3ubuntu1","2.6.1+dfsg1-3ubuntu2","2.6.1+dfsg1-3ubuntu2.1","2.6.1+dfsg1-3ubuntu2.2","2.6.1+dfsg1-3ubuntu2.3","2.6.1+dfsg1-3ubuntu2.4","2.6.1+dfsg1-3ubuntu2.5","2.6.1+dfsg1-3ubuntu2.6","2.6.1+dfsg1-3ubuntu2.7","2.6.1+dfsg1-3ubuntu2.8","2.6.1+dfsg1-3ubuntu2.9","2.6.1+dfsg1-3ubuntu2.10","2.6.1+dfsg1-3ubuntu2.11"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0+dfsg-0ubuntu0.24.04.1"}]}],"versions":["3.4.0+dfsg1-0ubuntu2","3.4.0+dfsg1-0ubuntu3","3.4.0+dfsg1-0ubuntu4","3.5.0+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1","3.5.1+dfsg1-0ubuntu1.1","3.5.1+dfsg1-0ubuntu1.2","3.5.1+dfsg1-0ubuntu1.4","3.5.1+dfsg1-0ubuntu1.5","3.5.1+dfsg1-0ubuntu1.6","3.30.0+dfsg-0ubuntu0.24.04.1","3.30.0+dfsg-0ubuntu0.24.04.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"freerdp2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.10.0+dfsg1-1.1ubuntu1","2.11.2+dfsg1-1","2.11.2+dfsg1-1build1","2.11.2+dfsg1-1build3","2.11.5+dfsg1-1build1","2.11.5+dfsg1-1build2","2.11.5+dfsg1-1ubuntu0.1~esm1","2.11.5+dfsg1-1ubuntu0.1~esm2","2.11.5+dfsg1-1ubuntu0.1~esm3","2.11.5+dfsg1-1ubuntu0.1~esm4","2.11.5+dfsg1-1ubuntu0.1~esm5","2.11.5+dfsg1-1ubuntu0.1~esm6"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"freerdp3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.31.0+dfsg-0ubuntu0.26.04.1"}]}],"versions":["3.16.0+dfsg-2","3.18.0+dfsg-1ubuntu1","3.19.0+dfsg-1","3.19.1+dfsg-1","3.20.0+dfsg-1","3.20.2+dfsg-1","3.21.0+dfsg-1","3.22.0+dfsg-1","3.24.1+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1","3.24.2+dfsg-1ubuntu1.1","3.30.0+dfsg-0ubuntu0.26.04.1","3.30.0+dfsg-0ubuntu0.26.04.2"]}],"products":[{"vendor":"freerdp","product":"freerdp"}],"references":[{"url":"https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-j5mq-3349-gwmm","tags":["vendor-advisory","Exploit","Vendor Advisory","advisory","report"]},{"url":"https://www.vulncheck.com/advisories/freerdp-before-3.31.0-use-after-free-via-smartcard-worker","tags":["third-party-advisory","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91957","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-h5f5-2qh4-2xjm"},{"url":"https://errata.tuxcare.com/els_os/centos7els/CLSA-2026-1791568721.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91953","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91956","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91959","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91963","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91964","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1791569293.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91957.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-91957","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-91957","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-91957","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-91957","title":"FreeRDP before 3.31.0 Use-After-Free via smartcard worker","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T15:18:12.622Z","modified":"2026-09-17T14:56:56.687Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low","assessor":"cna"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:19:52.773089Z"}],"euvd":[{"id":"EUVD-2026-78633","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T15:18:12Z","modified":"2026-09-17T14:56:56Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T17:28:12.076337Z"}],"ghsa":[{"id":"GHSA-h5f5-2qh4-2xjm","title":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device...","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T18:32:29Z","modified":"2026-09-15T18:32:34Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:11:54.818367Z"}],"nvd":[{"id":"CVE-2026-91957","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T16:17:50.647Z","modified":"2026-09-24T12:17:00.363Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low","assessor":"secondary"},{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:12:47.668237Z"}],"osv":[{"id":"CVE-2026-91957","title":"FreeRDP before 3.31.0 Use-After-Free via smartcard worker","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T15:18:12.622Z","modified":"2026-10-28T02:30:22.4855726Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"DEBIAN-CVE-2026-91957","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T16:17:50.647Z","modified":"2026-09-25T09:00:39.091904355Z","cvss":[{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"low"}],"updated_at":"2026-11-02T15:46:06.410207Z"},{"id":"UBUNTU-CVE-2026-91957","description":"FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.","status":"published","published":"2026-09-15T16:17:00Z","modified":"2026-09-24T02:02:55.336900854Z","cvss":[{"version":"3.1","score":3.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L","level":"low"},{"version":"4.0","score":2.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"low"}],"updated_at":"2026-11-02T16:57:40.980117Z"},{"id":"CLSA-2026-1791568721","title":"freerdp: Fix of 6 CVEs","description":"- CVE-2026-91953, CVE-2026-91964: bound every write in nego_send_negotiation_request() with Stream_EnsureRemainingCapacity(); the routing token taken from the server's LB_LOAD_BALANCE_INFO was written into a fixed 512 byte stream unchecked, overflowing the heap allocation\n- CVE-2026-91963: allocate wStream buffers with calloc() instead of malloc(), so the urbdrc completion path can no longer return the untouched tail of a freshly allocated buffer - and with it live heap pointers - to the server when a USB transfer returns short\n- CVE-2026-91959: require four remaining bytes in rts_read_result() before reading result and reason; a malicious RD Gateway could end a BIND_ACK fragment two bytes into a result and make the parser over-read it\n- CVE-2026-91957: do not free the SMARTCARD_DEVICE on the DeviceServiceEntry() failure path once RegisterDevice() has succeeded; devman kept the freed pointer and dereferenced DEVICE.Free through it on channel teardown\n- CVE-2026-91956: bound the interface, alternate-setting and endpoint indices in func_get_ep_desc(); it indexed by array position while the validator indexed by InterfaceNumber, so a permuted descriptor produced an out-of-bounds read of a pointer that was then dereferenced","status":"published","published":"2026-10-09T17:58:57Z","modified":"2026-10-26T09:43:21.843402422Z","updated_at":"2026-11-02T15:43:50.599064Z"},{"id":"CLSA-2026-1791569293","title":"freerdp: Fix of 6 CVEs","description":"- CVE-2026-91953, CVE-2026-91964: bound every write in nego_send_negotiation_request() with Stream_EnsureRemainingCapacity(); the routing token taken from the server's LB_LOAD_BALANCE_INFO was written into a fixed 512 byte stream unchecked, overflowing the heap allocation\n- CVE-2026-91963: allocate wStream buffers with calloc() instead of malloc(), so the urbdrc completion path can no longer return the untouched tail of a freshly allocated buffer - and with it live heap pointers - to the server when a USB transfer returns short\n- CVE-2026-91959: require four remaining bytes in rts_read_result() before reading result and reason; a malicious RD Gateway could end a BIND_ACK fragment two bytes into a result and make the parser over-read it\n- CVE-2026-91957: do not free the SMARTCARD_DEVICE on the DeviceServiceEntry() failure path once RegisterDevice() has succeeded; devman kept the freed pointer and dereferenced DEVICE.Free through it on channel teardown\n- CVE-2026-91956: bound the interface, alternate-setting and endpoint indices in func_get_ep_desc(); it indexed by array position while the validator indexed by InterfaceNumber, so a permuted descriptor produced an out-of-bounds read of a pointer that was then dereferenced","status":"published","published":"2026-10-09T18:08:29Z","modified":"2026-10-26T09:43:26.59218557Z","updated_at":"2026-11-02T15:43:50.599064Z"}]}}