VYPR
← All advisories
Low severity3.1NVD Advisory· Published Sep 15, 2026· Updated Sep 24, 2026

CVE-2026-91957

CVE-2026-91957

Description

FreeRDP before 3.31.0 contains a use-after-free vulnerability in the smartcard RDPDR device handler when worker thread creation fails after device registration. Attackers can trigger thread creation failure during channel setup to cause device pointer deallocation while devman retains a reference, leading to crash or code execution.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Freerdp/Freerdp2 versions
    cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*range: <3.31.0
    • (no CPE)range: <3.31.0

Patches

Vulnerability mechanics

References

2

News mentions

1