CVE-2026-91958
FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in xfreerdp.
- Published Sep 15, 2026
- CVSS 6.9 medium
- 0.2% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available