CVE-2026-91946

A flaw was found in FreeRDP. This information disclosure vulnerability exists in the RDPGFX server's ResetGraphics Protocol Data Unit (PDU) serializer. It fails to properly initialize padding bytes, allowing a remote attacker to receive uninitialized heap memory. This can lead to the disclosure of sensitive data, including live pointers and GLib function addresses, which could defeat Address Space Layout Randomization (ASLR) and reveal the GLib module's base address.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to FreeRDP server instances to only trusted clients and networks. Configure firewall rules to limit inbound connections to the RDP port (typically 3389) from untrusted sources. If FreeRDP server functionality is not required, consider disabling or uninstalling the FreeRDP server component.