SEPTEMBER 17, 2026
Live Feed
Back to database
Case File

CVE-2026-91954

MEDIUM · CVSS 6.5 EPSS 0.35% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-09-15 · Last synced 2026-09-17

CyberRota Analysis

AI-Generated

FreeRDP versions prior to 3.31.0 are vulnerable to a null pointer dereference in the gdi_surface_bits function, which can be exploited by a malicious RDP server to crash the client through specially crafted Surface Bits commands that falsely claim to use the NSCodec codec. This vulnerability poses a medium severity risk, primarily affecting users of FreeRDP who connect to potentially untrusted RDP servers. Organizations utilizing FreeRDP should prioritize updating to the latest version to mitigate the risk of service disruption.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

GitHub PoC Links

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-91954
Severity
MEDIUM
CVSS
6.5
EPSS
0.35%

Original NVD Description

FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.