CVE-2026-91948

7.7 highEPSS 0.6%

High (7.7). EPSS 0.6% chance of exploitation in the next 30 days.

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.

Severity

CVSS 4.0

7.7 high

CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-191
Published: 2026-09-15
Modified: 2026-09-17
Record from: the NVD, synced 2026-10-19

References

https://github.com/FreeRDP/FreeRDP/commit/40d9202cd95551600c07437ce6bd5ecd7d31e57b
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-9jcm-x588-gh26
https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-write-via-show-protocol

Check your stack JSON