Security Advisory

CVE-2026-91954

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-09-15 15:18:10

Last updated 2026-09-15 15:18:10

Assigner VulnCheck

CVSS score 7.1

State PUBLISHED

Description

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.

← Browse all CVEs View on cve.org ↗