CVE-2026-91956 FreeRDP CVE debrief

Who should care

Defenders responsible for FreeRDP clients, particularly those in environments where RDP is used, should assess exposure and prioritize remediation. This includes operators managing affected platforms, vulnerability management teams, and security teams responsible for ensuring the integrity of client systems. Version verification and patching of affected clients are crucial to prevent potential crashes and exploitation attempts.

Why it matters

CVE-2026-91956 is a high-severity vulnerability in FreeRDP before version 3.31.0. Defenders should assess exposure, prioritize remediation, and verify client versions to prevent potential crashes and exploitation attempts.

• Potential client crashes due to out-of-bounds read
• Need for version verification and patching of affected clients
• Possible exploitation attempts require monitoring

Technical summary

The vulnerability exists in the URBDRC channel's func_get_ep_desc function, which indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client. This issue affects FreeRDP before version 3.31.0, and defenders should prioritize remediation for clients in environments where RDP is used. The vulnerability allows for an out-of-bounds read via the URBDRC channel's func_get_ep_desc function.

Defensive priority

Remediation is recommended for FreeRDP clients prior to version 3.31.0. Assess exposure, verify client versions, and apply patches or updates as necessary.

Recommended defensive actions

• Assess exposure of FreeRDP clients in your environment
• Verify client versions and apply patches or updates as necessary
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from source references. FreeRDP clients prior to version 3.31.0 are affected. Defenders should verify client versions and review exposure to this vulnerability. Evidence is limited to public CVE and NVD sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.