Description
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.
Published: 2026-09-15
Score: 7.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

FreeRDP versions prior to 3.31.0 include an out‑of‑bounds write in the server‑side static virtual channel handler when the AUTHENTICATED clients can send oversized channel messages that trigger a buffer underflow, corrupting heap memory and altering live pointers. This memory corruption creates the potential for arbitrary code execution by the attacker.

Affected Systems

The vulnerability affects all FreeRDP releases before 3.31.0. It is specific to the FreeRDP:FreeRDP product family and impacts any system running an affected DP client/server library.

Risk and Exploitability

With a CVSS score of 7.7 the flaw is classified as high severity. The EPSS score is less than 1% and the vulnerability is not listed in CISA’s KEV catalog; it requires authenticated clients, making it a remote threat that requires valid user credentials or elevated client access. No public exploitation information is currently available, yet the high severity places this vulnerability on the top of the risk list for affected deployments.

Generated by OpenCVE AI on September 20, 2026 at 16:28 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FreeRDP installation to version 3.31.0 or later.
  • If an upgrade is not immediately possible, disable the CHANNEL_OPTION_SHOW_PROTOCOL option on the server to prevent the oversized message condition.
  • Monitor server logs for anomalous channel traffic and consider tightening authentication rules or restricting which users can enable channel protocol exposure.

Generated by OpenCVE AI on September 20, 2026 at 16:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 18 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-124
References
Metrics threat_severity

None

 threat_severity

Important

Tue, 15 Sep 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.
Title FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-191
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

cvssV4_0

{'score': 7.7, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-17T11:59:33.144Z

Reserved: 2026-09-15T11:07:01.913Z

Link: CVE-2026-91948

cve-icon Vulnrichment

Updated: 2026-09-15T16:02:28.419Z

cve-icon NVD

Status : Deferred

Published: 2026-09-15T16:17:48.503

Modified: 2026-09-17T12:18:29.793

Link: CVE-2026-91948

cve-icon Redhat

Severity : Important

Publid Date: 2026-09-15T15:18:06Z

Links: CVE-2026-91948 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T16:30:18Z

Weaknesses
  • CWE-124

    Buffer Underwrite ('Buffer Underflow')

  • CWE-191

    Integer Underflow (Wrap or Wraparound)