CVE-2026-91948: FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in server-side static virtual channel handling when CHANNELOPTIONSHOWPROTOCOL is enabled. Authenticated clients can queue oversized channel messages that cause buffer underflow and corrupt heap memory including live pointers, potentially enabling code execution.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Configuration
Disable CHANNEL_OPTION_SHOW_PROTOCOL to avoid the out-of-bounds write vulnerability in server-side static virtual channel handling.
FreeRDP server-side static virtual channel handling CHANNEL_OPTION_SHOW_PROTOCOL = disabled
Event History
Frequently Asked Questions
Which deployments are exposed?
FreeRDP versions before 3.31.0 are affected when they use server-side static virtual channels with CHANNEL_OPTION_SHOW_PROTOCOL enabled. Deployments without that option enabled are not identified as affected by the provided data.
What does an attacker need to exploit this issue?
An attacker must be an authenticated client and must be able to queue oversized channel messages. Exploitation has high attack complexity, but does not require user interaction.
What is the impact if exploitation succeeds?
Oversized messages can trigger a buffer underflow and out-of-bounds write that corrupts heap memory, including live pointers. This may enable code execution and can affect confidentiality, integrity, and availability.
What version should be used to remediate the issue?
Upgrade FreeRDP to version 3.31.0 or later. The affected range is versions before 3.31.0.