CVE-2026-91947

FreeRDP server versions before 3.31.0 contain a heap use-after-free (CWE-362 race condition) in the DRDYNVC (dynamic virtual channel) parser, caused by dereferencing a channel pointer after the synchronization lock has been released. An authenticated RDP client can trigger it by racing AUDIN (audio-input) channel closure messages against DRDYNVC data parsing, causing the server to access a channel object that has already been freed. Successful exploitation can crash the server or potentially lead to code execution with the privileges of the RDP server process (CVSS 4.0: 7.7, high impact on confidentiality, integrity, and availability). Any deployment running FreeRDP in server mode on a version earlier than 3.31.0 is affected; the attacker must hold valid RDP credentials, so this is primarily a privilege-escalation or service-disruption vector from an authenticated session. No public proof-of-concept exists, the flaw is not on the CISA KEV list, and no exploitation in the wild has been reported.

What to do: Upgrade FreeRDP to version 3.31.0 or later on any host running FreeRDP in server mode, including products that embed the FreeRDP server library. Until patched, restrict RDP exposure to trusted networks or VPN-only access, minimize the number of enabled accounts, and consider disabling audio-input (AUDIN) redirection for untrusted clients. Review server logs and crash dumps for abnormal terminations in the DRDYNVC or AUDIN parsing paths, which could indicate exploitation attempts.