CVE-2026-91956— FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP 3.31.0 之前的版本在 URBDRC 通道的 函数中存在一个越界读取漏洞。该函数在索引接口数组时，使用了“位置（position）”而非协议字段中的 。一个恶意的 RDP 服务器可以发送一个经过构造的 消息，其中 的值被故意打乱，从而使客户端读取超出已分配堆内存的范围，导致客户端崩溃。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91956
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's func_get_ep_desc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-91956
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91956
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-91956 (2)
-
-
🔗 FreeRDP before 3.31.0 Out-of-Bounds Read via URBDRC | Advisories | VulnCheck third-party-advisory
Same Patch Batch · FreeRDP · 2026-09-15 · 20 CVEs total
| CVE-2026-91949 | 9.3 CRITICAL | FreeRDP 3.0.0 through 3.30.0 Protocol Negotiation Bypass |
| CVE-2026-91964 | 8.8 HIGH | FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via RoutingToken |
| CVE-2026-91948 | 7.5 HIGH | FreeRDP before 3.31.0 Out-of-bounds Write via SHOW_PROTOCOL |
| CVE-2026-91947 | 7.5 HIGH | FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC |
| CVE-2026-91955 | 7.5 HIGH | FreeRDP before 3.31.0 Denial of Service via Desktop Dimensions |
| CVE-2026-91958 | 6.6 MEDIUM | FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index |
| CVE-2026-91960 | 6.5 MEDIUM | FreeRDP before 3.31.0 Integer Overflow Double Free |
| CVE-2026-91945 | 6.5 MEDIUM | FreeRDP before 3.31.0 Out-of-bounds Read via Smartcard ATR |
| CVE-2026-91952 | 6.5 MEDIUM | FreeRDP before 3.31.0 Denial of Service via pool_decode_rect |
| CVE-2026-91959 | 6.5 MEDIUM | FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway |
| CVE-2026-91954 | 6.5 MEDIUM | FreeRDP before 3.31.0 NULL Pointer Dereference via NSCodec |
| CVE-2026-91963 | 6.5 MEDIUM | FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc |
| CVE-2026-91961 | 6.5 MEDIUM | FreeRDP before 3.31.0 Denial of Service via URBDRC |
| CVE-2026-91953 | 6.5 MEDIUM | FreeRDP before 3.31.0 Heap Buffer Overflow via LB_LOAD_BALANCE_INFO |
| CVE-2026-91950 | 6.5 MEDIUM | FreeRDP before 3.31.0 Out-of-Bounds Read via UINT32 Wraparound |
| CVE-2026-91946 | 6.5 MEDIUM | FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics |
| CVE-2026-91951 | 6.5 MEDIUM | FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc |
| CVE-2026-91962 | 6.3 MEDIUM | FreeRDP before 3.31.0 Integer Overflow via audin Apple backends |
| CVE-2026-91957 | 3.1 LOW | FreeRDP before 3.31.0 Use-After-Free via smartcard worker |
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-91963
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Discl -
CVE-2026-91962
FreeRDP before 3.31.0 Integer Overflow via audin Apple backe -
CVE-2026-91960
FreeRDP before 3.31.0 Integer Overflow Double Free -
CVE-2026-91961
FreeRDP before 3.31.0 Denial of Service via URBDRC
Same vendor: FreeRDP
-
CVE-2026-91964
FreeRDP 2.0.0 through 3.30.0 Heap Buffer Overflow via Routin -
CVE-2026-91963
FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Discl -
CVE-2026-91962
FreeRDP before 3.31.0 Integer Overflow via audin Apple backe -
CVE-2026-91960
FreeRDP before 3.31.0 Integer Overflow Double Free -
CVE-2026-91961
FreeRDP before 3.31.0 Denial of Service via URBDRC
Same weakness: CWE-125
-
CVE-2026-92176
pdfforge PDF Architect App Object Out-Of-Bounds Read Remote -
CVE-2026-85234
Tftp: tftp-hpa: denial of service due to out-of-bounds read/ -
CVE-2026-55211
surfio IRAP header size fields cause out-of-bounds reads -
CVE-2026-91959
FreeRDP before 3.31.0 Buffer Over-read via RTS Gateway -
CVE-2026-91958
FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monit
V. Comments for CVE-2026-91956
No comments yet