Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91946FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
Medium 6.5
In plain English
A medium-severity security flaw in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | freerdp | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:10 | freerdp-devel | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:10 | freerdp-libs | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:10 | freerdp-server | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:10 | libwinpr | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:10 | libwinpr-devel | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-91946 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-91946 |
| Debian:14 | freerdp3 | 3.31.0+dfsg-1 | DEBIAN-CVE-2026-91946 |
| Rocky Linux:10 | freerdp | 2:3.10.3-12.el10_2.14 | RLSA-2026:75570 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-91946 |
| Ubuntu:24.04:LTS | freerdp3 | 3.31.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-91946 |
| Ubuntu:26.04:LTS | freerdp3 | 3.31.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-91946 |
Affected products (as reported)
Weakness: CWE-908 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-r7jx-j9h7-j4xj) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics third-party-advisory