CVE-2026-91946 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP deployments should assess exposure and prioritize verification and remediation, as the vulnerability allows information disclosure via the RDPGFX server's ResetGraphics PDU serializer.

Why it matters

CVE-2026-91946 is a high-severity information disclosure vulnerability in FreeRDP versions before 3.31.0. Defenders should prioritize verifying FreeRDP versions, assessing exposure, and remediating vulnerable deployments to prevent potential information disclosure attacks.

• Defenders must verify FreeRDP versions to determine exposure
• Successful exploitation may allow attackers to disclose GLib module base addresses
• Remediation requires updating FreeRDP to version 3.31.0 or later

Technical summary

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer. The serializer fails to initialize padding bytes in the fixed 340-byte wire format, allowing attackers to receive uninitialized heap memory, including live pointers and GLib function addresses. This vulnerability allows information disclosure via the RDPGFX server's ResetGraphics PDU serializer. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.

Defensive priority

Defenders should prioritize verifying FreeRDP versions and assessing exposure, as the vulnerability allows information disclosure via the RDPGFX server's ResetGraphics PDU serializer.

Recommended defensive actions

• Verify FreeRDP versions and assess exposure
• Review and update FreeRDP to version 3.31.0 or later
• Monitor for potential information disclosure attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the information disclosure vulnerability in FreeRDP versions before 3.31.0. The vulnerability is caused by the RDPGFX server's ResetGraphics PDU serializer failing to initialize padding bytes in the fixed 340-byte wire format.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.