CVE-2026-91958

A flaw was found in FreeRDP. This vulnerability allows a remote attacker to trigger out-of-bounds memory access by crafting a malicious Remote Desktop Protocol (RDP) connection file. When a user opens this file, the FreeRDP client fails to properly validate array values, leading to a heap buffer overflow. This can result in a denial of service, causing the application to crash, and potentially lead to information disclosure or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, users should exercise caution and avoid opening RDP connection files from untrusted or unknown sources. This vulnerability requires user interaction with a malicious file to be exploited.