CVE-2026-91950: Freerdp

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.

Affected products

• Freerdp Freerdp: before 3.31.0 (fixed in 3.31.0)

Published 2026-09-15. Last modified 2026-09-24.