CVE-2026-91946: FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics
FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP deployments using a version before 3.31.0 and operating an RDPGFX server are exposed. The affected serializer is on the server side.
What level of access does an attacker need?
The supplied CVSS vector indicates network access is sufficient but that the attacker must have low privileges. No user interaction is required.
What information can be disclosed?
A successful attack can return uninitialized heap memory in a ResetGraphics PDU, including live pointers and GLib function addresses. This may defeat heap ASLR and reveal the GLib module base address.
How can this be remediated?
Update FreeRDP to version 3.31.0 or later. The issue affects versions before 3.31.0.