CVE-2026-91946

FreeRDP before 3.31.0 ships an RDPGFX server component whose ResetGraphics PDU serializer fails to initialize padding bytes in the fixed 340-byte wire format, transmitting uninitialized heap memory back to the connected client. A malicious client that connects to a FreeRDP-based RDP server and triggers graphics-reset handling receives the leaked bytes, which can include live heap pointers and GLib function addresses. This does not crash or compromise the server directly, but it defeats heap ASLR by disclosing the GLib module base address, providing a high-value primitive for chaining with memory-corruption bugs. Affected parties are organizations running FreeRDP's server side (e.g., freerdp-shadow-based services or appliances/thin clients embedding FreeRDP server) at any version before 3.31.0; typical FreeRDP desktop-client users are not the vulnerable party here. No public PoC exists and there is no indication of exploitation in the wild, though the flaw is remotely triggerable by any client able to establish a session.

What to do: Upgrade FreeRDP to 3.31.0 or later and rebuild/redeploy any product that embeds the FreeRDP server (shadow services, thin clients, remote-access appliances) — check vendor advisories for firmware updates. Until patched, restrict who can reach FreeRDP-based RDP endpoints with network ACLs, VPN gating, and strong authentication, since the leak is returned to any client that can complete a session. If supported by the configuration, consider disabling the RDPGFX (graphics pipeline) channel and audit logs for anomalous clients repeatedly initiating graphics resets.