Out-of-Bounds Read Vulnerability in FreeRDP by FreeRDP Project
CVE-2026-91956

7.1HIGH

Key Information:

Vendor

Freerdp

Status
Freerdp
Vendor
CVE Published:
15 September 2026

What is CVE-2026-91956?

FreeRDP, prior to version 3.31.0, is susceptible to an out-of-bounds read due to a flaw in the URBDRC channel's func_get_ep_desc function. This vulnerability arises when the RDP server sends a crafted SELECT_CONFIGURATION message, leading to improper indexing into interface arrays based on position instead of the correct protocol field InterfaceNumber. An attacker can exploit this vulnerability to read beyond allocated heap memory, potentially causing the client to crash.

Affected Version(s)

FreeRDP 0 < 3.31.0

FreeRDP 3.31.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/freerdp-before-3.31....
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Baixingyuu
KeenSecurityLab
.