CVSS 4.0
6.9 mediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:NCVE-2026-91958
Medium (6.9) in freerdp freerdp. EPSS 0.2% chance of exploitation in the next 30 days.
FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in xfreerdp.
Severity
CVSS 3.1
6.6 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
- CWE
- CWE-125
- Published
- Modified
- Record from
- the NVD, synced
Affected
- freerdp:freerdp