MEDIUM

CVE-2026-91950

2026-09-15 CVSS v3.1

CVSS

6.5

Description

FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.

Weakness (CWE)

CWE-125 Out-of-bounds Read

EPSS Score

0.45%

Probability of exploitation in next 30 days

38.5th percentile

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-c5gr-hmqp-pwj4 https://www.vulncheck.com/advisories/freerdp-before-3.31.0-out-of-bounds-read-via-uint32-wraparound

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE