What’s Vulnerable › Vulnerabilities

CVE-2026-91946: FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-15 · updated 2026-09-24
• Weakness: CWE-908

Description

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.

Affected products

• FreeRDP: from 2.0.0 before 3.31.0 — fixed in 3.31.0

How to fix

Upgrade to a fixed version: FreeRDP 3.31.0. Check the vendor advisory for mitigations.

References

• https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj
• https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-rdpgfx-resetgraphics
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj

Get alerted when CVE-2026-91946 or the next vulnerability affects your stack