What is CVE-2026-91948?

CVE-2026-91948 is a high-severity vulnerability in Freerdp, classified under Integer Underflow. CVSS score: 7.5/10. Published 2026-09-15.

How severe is CVE-2026-91948?

High severity. CVSS v3 base score is 7.5 out of 10.

Integer overflow in Freerdp

CVE-2026-91948

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Freerdp

Weakness classification (CWE)

CWE-191 — Integer Underflow

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91948?: CVE-2026-91948 is a high-severity vulnerability in Freerdp, classified under Integer Underflow. CVSS score: 7.5/10. Published 2026-09-15.
How severe is CVE-2026-91948?: High severity. CVSS v3 base score is 7.5 out of 10.