CVE-2026-91950
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the rdpdr_dump_packet function due to 32-bit unsigned integer wraparound in buffer bounds validation. A malicious RDP server can send a crafted RDPDR packet with computerNameLen set to 0xFFFFFFF0 to bypass bounds checks and trigger memory reads past the packet buffer, causing client crashes or heap disclosure in logs.
- Published Sep 15, 2026
- CVSS 7.1 high
- 0.4% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available