Null Pointer Dereference in FreeRDP Client Due to Malicious Surface Bits Commands

CVE-2026-91954

What is CVE-2026-91954?

FreeRDP clients prior to version 3.31.0 are susceptible to a null pointer dereference vulnerability caused by improper handling of Surface Bits commands associated with the NSCodec codec ID. This flaw can be exploited by a malicious RDP server to craft specific Surface Bits commands, leading to a crash of the FreeRDP client, even when the NSCodec feature is not enabled. This vulnerability emphasizes the necessity for users to update their FreeRDP clients to mitigate potential disruptions in service.

References