CVE-2026-91947: Freerdp

High severity, CVSS 7.5. EPSS: 0.3% chance of exploitation in the next 30 days.

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

Affected products

• Freerdp Freerdp: from 2.0.0, before 3.31.0 (fixed in 3.31.0)

Published 2026-09-15. Last modified 2026-09-24.