CVE-2026-91946

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-91946

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-91946.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2026-91946

Aliases

GHSA-r7jx-j9h7-j4xj

Downstream

Published

2026-09-15T15:18:05Z

Modified

2026-10-06T08:31:44Z

Severity

7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

FreeRDP before 3.31.0 Information Disclosure via RDPGFX ResetGraphics

Details

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-908"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91946.json"
}

References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type

GIT

Repo

https://github.com/freerdp/freerdp

Events

Introduced

5ab2bed8749747b8e4b2ed431fd102bc726be684

Fixed

aa8650b300aa4cabd85d9c72b431301509b9043f

Fixed

483c9388119f06bac420d92053cff9ef94e83bea

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
    "extracted_events":  [
        {
            "introduced":  "2.0.0"
        },
        {
            "fixed":  "3.31.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*

2.0.0

3.*

3.0.0

3.0.0-beta1

3.0.0-beta2

3.0.0-beta3

3.0.0-beta4

3.0.0-rc0

3.1.0

3.2.0

3.3.0

3.4.0

3.5.0

3.5.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-91946.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "231867432041682170192096907494199930447",
            "length":  538
        },
        "id":  "CVE-2026-91946-40e2ddd5",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/freerdp/freerdp/commit/483c9388119f06bac420d92053cff9ef94e83bea",
        "target":  {
            "file":  "winpr/libwinpr/utils/stream.c",
            "function":  "Stream_New"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "66526936321550674325845669864391672062",
                "149106399525389394430996085745748489367",
                "59677448220993466901669150830539309647",
                "205118646075812973770254754242893582082"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-91946-af7be01d",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/freerdp/freerdp/commit/483c9388119f06bac420d92053cff9ef94e83bea",
        "target":  {
            "file":  "winpr/libwinpr/utils/stream.c"
        }
    }
]

vanir_signatures_modified

"2026-10-06T08:31:44Z"