CVE-2026-91957: FreeRDP before 3.31.0 Use-After-Free via smartcard worker

Published Sep 15, 2026
·
Updated

FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.

Affected Software

1 affected component
FreeRDP freerdp<3.31.0

Event History

Sep 15, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

Which deployments are exposed to this issue?

FreeRDP versions before 3.31.0 are affected when the smartcard RDPDR device handler is involved during channel setup. The issue is in the smartcard worker-thread path.

2

What must an attacker do to trigger the vulnerability?

An attacker must trigger worker-thread creation failure after the smartcard device has been registered during channel setup. This can leave the device manager holding a reference to a deallocated device pointer.

3

What is the potential impact?

Successful exploitation can cause a crash and may lead to code execution. The supplied severity vector rates availability impact as low and does not identify confidentiality or integrity impact.

4

How can this be remediated?

Upgrade FreeRDP to version 3.31.0 or later. The provided data does not specify a workaround for environments that cannot immediately upgrade.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203