CVE-2026-91954

FreeRDP before 3.31.0 contains a null pointer dereference (CWE-476) in the gdi_surface_bits function, which handles RDP Surface Bits commands used to deliver graphical updates to the client. A malicious or compromised RDP server triggers the crash by sending a crafted Surface Bits command that declares the NSCodec codec ID, and the bug fires even when the NSCodec codec is disabled on the client, so turning the codec off is not a workaround. The impact is denial of service only: the FreeRDP client crashes, with no confidentiality or integrity impact, consistent with the CVSS 4.0 score of 7.1 driven by high availability impact. Anyone running a FreeRDP-based client below 3.31.0 (such as xfreerdp or downstream products like Remmina and embedded RDP clients) who connects to an untrusted server is affected, since the attacker is the server side of the session. No public proof of concept is known and the issue is not listed in CISA's KEV, so exploitation status is none known.

What to do: Upgrade to FreeRDP 3.31.0 or later, or apply your distribution's patched freerdp/freerdp3 package as soon as it is available. Note that disabling NSCodec does not mitigate the crash, so patching is the only reliable fix. Audit embedded or OEM products (thin clients, remote-workspace apps) that bundle FreeRDP for updated builds, and remind users to connect only to trusted RDP servers.