Skip to content
CVE PROGRAM SOURCE RECORD7.7 High

CVE-2026-91947

FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

FreeRDP FreeRDP

Default version status: unaffected

  • 2.0.0 to < 3.31.0affected
  • 3.31.0unaffected

References