CVE-2026-91958

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-91958

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91958.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-91958

Aliases

GHSA-23pf-q83q-x45r

Downstream

Published

2026-09-15T15:18:13Z

Modified

2026-10-28T02:30:57Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

FreeRDP 3.11.0 through 3.30.0 Heap Buffer Overflow via Monitor Index

Details

FreeRDP versions before 3.31.0 fail to validate MonitorIds array values when parsing RDP connection files, allowing unbounded array indexing in xf_detect_monitors. Attackers can craft a malicious RDP file with an out-of-range selectedmonitors value to trigger out-of-bounds heap read and write operations when opened in xfreerdp.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-125"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/91xxx/CVE-2026-91958.json"
}

References

Affected packages

Git / github.com/freerdp/freerdp

Affected ranges

Type

GIT

Repo

https://github.com/freerdp/freerdp

Events

Introduced

4312666c8f89cb5464fc6e79423d1d7e33683ebe

Fixed

aa8650b300aa4cabd85d9c72b431301509b9043f

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "3.11.0"
                },
                {
                    "fixed":  "3.31.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "cpe":  "cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "3.11.0"
                },
                {
                    "fixed":  "3.31.0"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-91958.json"