CVE-2026-91947: FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC
FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP Serverto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to be an authenticated client of a vulnerable FreeRDP Server instance. Exploitation also requires the attacker to win a race between AUDIN channel closure messages and DRDYNVC data parsing.
Which deployments are affected?
FreeRDP Server versions before 3.31.0 are affected. The provided information does not identify any configuration prerequisite beyond use of the affected server and the relevant channel handling.
What is the impact if exploitation succeeds?
Successful exploitation triggers a heap use-after-free involving freed channel objects. The vulnerability is rated high and has high confidentiality, integrity, and availability impacts.