CVE-2026-91958

MediumCVSS 6.6/10Last modified Sep 24, 2026

Description

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in xfreerdp.

Metrics

CVSS 3.1 6.6/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-125

Affected software

Vendor	Product	Versions
FreeRDP	FreeRDP	>= 3.11.0, < 3.31.0

References

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23pf-q83q-x45rExploit, Mitigation, Vendor Advisory
https://www.vulncheck.com/advisories/freerdp-3.11.0-through-3.30.0-heap-buffer-overflow-via-monitor-indexThird Party Advisory
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-23pf-q83q-x45rExploit, Mitigation, Vendor Advisory

Timeline

Published: Sep 15, 2026
Last modified: Sep 24, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-919596.5FreeRDP before 3.31.0 contains a buffer over-read vulnerability in the rts_read_result function within the RPC gateway transport parser. Att CVE-2026-91968.8IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authenticated attacker to execute unintended code during Agentic Assistant validation d CVE-2026-919606.5FreeRDP versions before 3.31.0 contain an integer overflow in WinPR's Stream_EnsureRemainingCapacity function that allows remote attackers t CVE-2026-919616.5FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBu CVE-2026-919626.3FreeRDP before 3.31.0 contains an integer overflow in the audin Apple backends when processing FramesPerPacket values from MSG_SNDIN_OPEN me CVE-2026-919636.5FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malici CVE-2026-919648.8FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in nego_send_negotiation_request when processing Server Redirection PDU CVE-2026-919657.5WWBN AVideo through 29.0 fails to enforce user-group restrictions in the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoi CVE-2026-919665.8AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accep CVE-2026-919675.0AVideo through 29.0 contains a blind server-side request forgery vulnerability in the getHeaderContentTypeFromURL function that issues get_h CVE-2026-919686.5vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the task-filter endpoint that accepts deeply nested filter expr CVE-2026-919696.5vikunja versions before 2.6.0 contain a resource exhaustion vulnerability in the POST /api/v2/migration/csv/migrate endpoint that fails to l