Vulnerability Description
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/FreeRDP/FreeRDP/commit/40d9202cd95551600c07437ce6bd5ecd7d31e5
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jcm-x588-gh26
- https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-write-v
FAQ
What is CVE-2026-91948?
CVE-2026-91948 is a vulnerability with a CVSS score of 7.5 (HIGH). FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue...
How severe is CVE-2026-91948?
CVE-2026-91948 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-91948?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.