PT-2026-92075

CVE-2026-91956

Published

2026-09-15

Updated

2026-10-29

Description by

CVSS 4.0

8.7

High

MetricsAV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description An out-of-bounds read occurs in the func get ep desc() function within the URBDRC channel. The issue arises because interface arrays are indexed by position rather than by the protocol field InterfaceNumber. A malicious RDP server can trigger this by sending a crafted SELECT CONFIGURATION message with permuted InterfaceNumber values, allowing the server to read past allocated heap memory and cause the client to crash.

Recommendations Update FreeRDP to version 3.31.0 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Baixingyuu

Keensecuritylab

Vendors

Affected products

Weakness enumeration

CWE-125: Out-of-bounds Read