CVE-2026-91954

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can trigger a null pointer dereference in the gdi_surface_bits function by sending a specially crafted Surface Bits command that claims to use the NSCodec codec ID. This vulnerability exists even when the NSCodec is disabled in the client. Successful exploitation allows a remote attacker to cause a FreeRDP client to crash, leading to a denial of service.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should avoid connecting to untrusted or unknown RDP servers with FreeRDP clients. This vulnerability requires a FreeRDP client to connect to a malicious RDP server to be exploited.