What is CVE-2026-91957?

CVE-2026-91957 is a low-severity vulnerability in Freerdp, classified under Use After Free. CVSS score: 3.1/10. Published 2026-09-15.

How severe is CVE-2026-91957?

Low severity. CVSS v3 base score is 3.1 out of 10.

Use After Free in Freerdp

CVE-2026-91957

FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.

Vulnerability class: Use-After-Free

CVSS v3 metric

CVSS v3 base score 3.1 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L.

Affected products

Freerdp

Weakness classification (CWE)

CWE-416 — Use After Free

References

disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-91957?: CVE-2026-91957 is a low-severity vulnerability in Freerdp, classified under Use After Free. CVSS score: 3.1/10. Published 2026-09-15.
How severe is CVE-2026-91957?: Low severity. CVSS v3 base score is 3.1 out of 10.