CVE-2026-91954: FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec
FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdisurfacebits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0 - Configuration
Ensure FreeRDP is upgraded to 3.31.0 or later; the NULL pointer dereference occurs in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID even when the codec is disabled.
FreeRDP NSCodec codec ID handling in Surface Bits (gdi_surface_bits) = Disable/avoid processing crafted Surface Bits commands using NSCodec codec ID
Event History
Frequently Asked Questions
Which systems are realistically exposed to this issue?
FreeRDP clients running versions earlier than 3.31.0 are exposed when they connect to a malicious RDP server. The issue affects the client, not an RDP server being connected to.
What must an attacker do to trigger the crash?
An attacker needs to operate or control an RDP server that the victim connects to and send a crafted Surface Bits command claiming the NSCodec codec ID. No attacker privileges on the client are indicated, but user interaction is required because the client must initiate the RDP connection.
Does disabling NSCodec mitigate the issue?
No. The crafted command can trigger the null pointer dereference even when NSCodec is disabled.
How can I determine whether an installation is affected?
Check the installed FreeRDP version. Versions before 3.31.0 are affected; upgrading to 3.31.0 or later addresses the affected version range.