Security Advisory

CVE-2026-91948

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-15 15:18:06

Last updated 2026-09-15 16:03:29

Assigner VulnCheck

CVSS score 7.7

State PUBLISHED

Description

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.

← Browse all CVEs View on cve.org ↗