CVE-2026-91947

A flaw was found in FreeRDP server. This use-after-free vulnerability exists in the DRDYNVC parser, where a channel pointer is dereferenced after its synchronization lock has been released. An authenticated client can exploit this by racing AUDIN channel closure messages against DRDYNVC data parsing, leading to memory corruption. This could potentially result in arbitrary code execution or a denial of service.

This vulnerability is rated as Important severity because an authenticated remote attacker could trigger memory corruption leading to service denial or arbitrary code execution, though exploitation requires winning a race condition during session teardown. In Red Hat Enterprise Linux, FreeRDP is primarily utilized as a client-side suite and library, and server-side components are not enabled or running by default in standard installations. Consequently, typical systems are not exposed to this flaw unless an administrator explicitly deploys an RDP server implementation utilizing the affected FreeRDP server libraries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The vulnerability requires an authenticated client to interact with the FreeRDP server. To mitigate this issue, restrict network access to the FreeRDP server to only trusted clients and networks. If the FreeRDP server functionality is not required, consider disabling or uninstalling the FreeRDP server component to eliminate the attack surface.