Threat intelligence dashboard
CVE-2026-91947high

FreeRDP Server before 3.31.0 Use-After-Free via DRDYNVC

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

Risk score

7.7

CVSS 4.0

Vendor
FreeRDP
Product
FreeRDP
CWE
CWE-362
Published
Sep 15, 2026
Updated
Sep 16, 2026
CISA KEV
Not flagged

Affected products and versions

FreeRDP

FreeRDP

Version / rangeStatusType
2.0.0 to before 3.31.0affectedsemver
3.31.0unaffectedsemver

Technical metrics

7.7

CVSS 4.0

Severity
high
Source
VulnCheck
Vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

7.5

CVSS 3.1

Severity
high
Source
VulnCheck
Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H