CVE-2026-91957
Last modified
CVE-2026-91957 is a low-severity vulnerability rated 3.1/10 on the CVSS scale. FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.. EPSS estimates a 0.33% chance of exploitation in the next 30 days.
Description
FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| FreeRDP | FreeRDP | < 3.31.0 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-91957?
How severe is CVE-2026-91957?
How do I fix CVE-2026-91957?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-91951FreeRDP versions before 3.31.0 contain an out-of-bounds writ…6.5
- CVE-2026-91952FreeRDP versions before 3.31.0 contain an infinite-loop deni…6.5
- CVE-2026-91953FreeRDP versions before 3.31.0 contain a heap buffer overflo…6.5
- CVE-2026-91954FreeRDP before 3.31.0 contains a null pointer dereference vu…6.5
- CVE-2026-91955FreeRDP before 3.31.0 fails to validate client-supplied Desk…7.5
- CVE-2026-91956FreeRDP before 3.31.0 contains an out-of-bounds read vulnera…6.5
- CVE-2026-91958FreeRDP versions before 3.31.0 fail to validate MonitorIds a…6.6
- CVE-2026-91959FreeRDP before 3.31.0 contains a buffer over-read vulnerabil…6.5
- CVE-2026-9196IBM Langflow OSS 1.0.0 through 1.10.3 could allow an authent…8.8
- CVE-2026-91960FreeRDP versions before 3.31.0 contain an integer overflow i…6.5
- CVE-2026-91961FreeRDP before 3.31.0 contains a denial-of-service vulnerabi…6.5
- CVE-2026-91962FreeRDP before 3.31.0 contains an integer overflow in the au…6.3
Are you affected by CVE-2026-91957?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST