CVE-2026-91948

A flaw was found in FreeRDP. An authenticated client can send specially crafted, oversized messages to the server when the CHANNEL_OPTION_SHOW_PROTOCOL feature is active. This can cause a buffer underflow, leading to corruption of memory and potentially allowing an attacker to execute malicious code on the server.

This vulnerability is rated as Important severity because an authenticated remote attacker can achieve arbitrary code execution within the server process by transmitting malformed virtual channel data. While exploitation requires low-privilege authentication and specific channel tracking options, the resulting pointer overwrite and potential control-flow hijacking elevate the impact above Moderate. In Red Hat Enterprise Linux environments, FreeRDP is predominantly consumed as a client library, limiting server-side exposure to systems explicitly hosting remote desktop services.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, restrict network access to the FreeRDP server to only trusted clients or localhost. This can be achieved by configuring firewall rules to limit inbound connections to the FreeRDP service port. A restart of the FreeRDP server may be required for network configuration changes to take effect.