CVE-2026-91957
Received Received - Intake

Use-After-Free in FreeRDP Smartcard RDPDR Device Handler

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91957
EUVD
EUVD-2026-78633

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
freerdp freerdp to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.31.0 has a use-after-free flaw in the smartcard RDPDR device handler. When a worker thread creation fails after device registration, the device pointer gets deallocated while the device manager still holds a reference. This leads to a use-after-free condition during channel teardown, potentially causing crashes or code execution.

Detection Guidance

Detecting this vulnerability requires checking FreeRDP versions and monitoring for crashes or heap-use-after-free errors during smartcard redirection. Use 'xfreerdp --version' or 'freerdp2 --version' to check if your version is below 3.31.0. Enable AddressSanitizer during compilation to detect heap-use-after-free errors during testing.

Impact Analysis

This vulnerability can cause crashes in FreeRDP applications using smartcard redirection. While remote code execution is not confirmed, attackers could trigger crashes by exploiting thread creation failure during channel setup. The impact is limited to local crashes in native builds.

Mitigation Strategies

Upgrade FreeRDP to version 3.31.0 or later immediately. If upgrading is not possible, disable smartcard redirection in FreeRDP configurations to prevent the vulnerable code path from being triggered.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91957. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart