CVE-2026-91956: Out-of-bounds Read

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumbe...

CVE-2026-91963: Use of Uninitialized Variable

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

CVE-2026-91964: Heap-based Buffer Overflow

FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written...

PT-2026-92069

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description An out-of-bounds read occurs in the rdpdr dump packet function due to a 32-bit unsigned integer wraparound during buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet wit...

PT-2026-92078

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description A buffer over-read occurs in the rts read result function within the RPC gateway transport parser. An attacker can trigger an out-of-bounds read, leading to a process abort, by sending a malicious...

PT-2026-92082

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0 Description An uninitialized heap memory disclosure exists in the urbdrc USB redirection channel. A malicious RDP server can trigger failing USB transfers to read uninitialized heap memory from the client. This...

CVE-2026-91963: Use of Uninitialized Variable

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when...

CVE-2026-91948: Integer Underflow (Wrap or Wraparound)

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live...

CVE-2026-91952: Loop with Unreachable Exit Condition

FreeRDP versions before 3.31.0 contain an infinite-loop denial of service in the pooldecoderect function when decoding AVC444 metablocks with more region rectangles than preallocated worker array size. A malicious RDP server can send crafted AVC444 graphics updates causing the threaded decode pat...

PT-2026-92066

Name of the Vulnerable Software and Affected Versions FreeRDP server versions prior to 3.31.0 Description A use-after-free issue exists in the DRDYNVC parser. This occurs when a channel pointer is dereferenced after the synchronization lock has been released. Authenticated clients can trigger a...

Linux Distros Unpatched Vulnerability : CVE-2026-91947

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the...

Linux Distros Unpatched Vulnerability : CVE-2026-91964

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with...

Linux Distros Unpatched Vulnerability : CVE-2026-91958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xfdetectmonitors...

Linux Distros Unpatched Vulnerability : CVE-2026-91963

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can...

Linux Distros Unpatched Vulnerability : CVE-2026-91949

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP server versions before 3.31.0 contain a protocol negotiation bypass vulnerability that allows unauthenticated attackers to establish RDSTLS connections...

Linux Distros Unpatched Vulnerability : CVE-2026-91953

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest that fails to validate the LBLOADBALANCEINFO field...

Linux Distros Unpatched Vulnerability : CVE-2026-91955

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FreeRDP before 3.31.0 fails to validate client-supplied DesktopWidth and DesktopHeight values during GCC negotiation, allowing remote attackers to crash the...

CVE-2026-91951: Reachable Assertion

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denia...

CVE-2026-91950: Out-of-bounds Read

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdrdumppacket function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigg...

CVE-2026-91959: Out-of-bounds Read

FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rtsreadresult function within the RPC gateway transport parser. Attackers can send a malicious BINDACK PDU with a truncated result entry to trigger an out-of-bounds read causing process abort...