Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck

CVE-2026-91954FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec

Medium 6.5

In plain English

A medium-severity null pointer dereference in FreeRDP from FreeRDP. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.4%top 66.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10freerdp2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8freerdp2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9freerdp2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10freerdp-devel2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8freerdp-devel2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9freerdp-devel2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10freerdp-libs2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8freerdp-libs2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9freerdp-libs2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10freerdp-server2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:10libwinpr2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8libwinpr2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9libwinpr2:2.11.7-7.el9_8.8ALSA-2026:76755
AlmaLinux:10libwinpr-devel2:3.10.3-12.el10_2.14ALSA-2026:75570
AlmaLinux:8libwinpr-devel2:2.11.7-14.el8_10ALSA-2026:76747
AlmaLinux:9libwinpr-devel2:2.11.7-7.el9_8.8ALSA-2026:76755
Debian:12freerdp2no fix listedDEBIAN-CVE-2026-91954
Debian:13freerdp3no fix listedDEBIAN-CVE-2026-91954
Debian:14freerdp33.31.0+dfsg-1DEBIAN-CVE-2026-91954
Rocky Linux:10freerdp2:3.10.3-12.el10_2.14RLSA-2026:75570
Rocky Linux:8freerdp2:2.11.7-14.el8_10RLSA-2026:76747
Rocky Linux:9freerdp2:2.11.7-7.el9_8.8RLSA-2026:76755
Ubuntu:22.04:LTSfreerdp2no fix listedUBUNTU-CVE-2026-91954
Ubuntu:24.04:LTSfreerdp33.31.0+dfsg-0ubuntu0.24.04.1UBUNTU-CVE-2026-91954
Ubuntu:26.04:LTSfreerdp33.31.0+dfsg-0ubuntu0.26.04.1UBUNTU-CVE-2026-91954

Affected products (as reported)

VendorProductVersions
FreeRDP FreeRDP 0 – before 3.31.0

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References