CVE-2026-91947
Received Received - Intake

Use-After-Free in FreeRDP Server

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91947
EUVD
EUVD-2026-78804

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freerdp freerdp to 3.31.0 (exc)
freerdp freerdp_server to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-362 The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in FreeRDP server versions before 3.31.0. The DRDYNVC parser dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

Detection Guidance

Detecting this vulnerability requires monitoring FreeRDP server versions and analyzing memory access patterns. Check FreeRDP version with 'xfreerdp --version' or 'apt show freerdp2-server'. Enable AddressSanitizer in FreeRDP builds to detect use-after-free conditions during runtime. Monitor server logs for abnormal channel closure events or memory corruption errors.

Impact Analysis

If exploited, this vulnerability could lead to memory corruption, potential crashes, or unauthorized access to sensitive data. It may allow attackers to execute arbitrary code or cause denial-of-service conditions on affected FreeRDP servers.

Mitigation Strategies

Upgrade FreeRDP server to version 3.31.0 or later immediately. Disable dynamic virtual channels if not required. Restrict network access to FreeRDP servers to trusted clients only. Monitor for suspicious activity and apply patches as they become available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91947. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart