high7.5
CVE-2026-91948
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is…
Impact
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNEL_OPTION_SHOW_PROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.
Affected products
| Product | Affected versions |
|---|---|
| FreeRDP | before 3.31.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.