CVE-2026-91947: FreeRDP Use-After-Free Vulnerability

CVE-2026-91947 Overview

CVE-2026-91947 is a use-after-free vulnerability in FreeRDP server versions before 3.31.0. The flaw resides in the Dynamic Virtual Channel (DRDYNVC) parser, which dereferences a channel pointer after releasing the associated synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to access freed channel objects.

FreeRDP is a widely deployed open-source implementation of the Remote Desktop Protocol used in remote access gateways, virtualization stacks, and Linux desktop environments. Successful exploitation can lead to memory corruption and potential code execution in the server process.

Critical Impact
Authenticated attackers can trigger heap-use-after-free in the FreeRDP server, enabling memory corruption that may result in remote code execution or denial of service.

Affected Products

FreeRDP server versions prior to 3.31.0
Applications embedding the FreeRDP server library with DRDYNVC support
Deployments exposing AUDIN dynamic virtual channels to authenticated clients

Discovery Timeline

2026-09-15 - CVE-2026-91947 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91947

Vulnerability Analysis

The vulnerability is a race condition [CWE-362] that produces a heap use-after-free within the FreeRDP DRDYNVC parser. DRDYNVC multiplexes Microsoft RDP dynamic virtual channels, including the AUDIN audio input channel. The server parses incoming PDUs on one execution path while channel lifecycle events are processed on another.

When an authenticated client sends an AUDIN channel closure message concurrently with additional DRDYNVC data frames, the parser releases the synchronization lock protecting the channel table before completing all pointer accesses. A second thread can free the channel object during that window. The parser then dereferences the stale pointer, operating on memory that has been returned to the heap allocator.

Because the freed region may be reallocated with attacker-influenced data, an adversary can shape heap contents to overlap the freed channel object. This creates conditions for controlled memory writes, information disclosure, or process crashes within the FreeRDP server context.

Root Cause

The root cause is improper lock scoping in the DRDYNVC channel handler. The synchronization primitive protecting the channel object is released prior to the final dereference, breaking the invariant that the pointer remains valid for the duration of its use. Channel closure paths do not coordinate with in-flight parser operations, allowing the object lifetime to end while it is still referenced.

Attack Vector

Exploitation requires network access to a FreeRDP server and valid credentials to complete the RDP handshake. Once authenticated, the client negotiates DRDYNVC and opens an AUDIN dynamic channel. The attacker then interleaves AUDIN close PDUs with DRDYNVC data PDUs targeting the same channel identifier, racing the parser against channel teardown.

The attack complexity is elevated because success depends on winning a narrow timing window between lock release and pointer dereference. Repeated attempts with tuned message ordering increase the probability of triggering the freed access. Reference details are available in the GitHub Security Advisory GHSA-6mpx-c8rj-whj5 and the VulnCheck FreeRDP Use-After-Free Advisory.

No public proof-of-concept exploit is currently listed for this issue.

Detection Methods for CVE-2026-91947

Indicators of Compromise

Unexpected FreeRDP server process crashes or segmentation faults with stack frames referencing DRDYNVC parsing routines
Authenticated RDP sessions that repeatedly open and rapidly close AUDIN dynamic channels within short intervals
Heap corruption signatures in core dumps or AddressSanitizer output tied to freed channel objects

Detection Strategies

Enable AddressSanitizer or heap protection tooling in non-production FreeRDP builds to surface use-after-free conditions during testing
Correlate RDP authentication logs with process crash events on hosts running FreeRDP server binaries
Inspect network telemetry for DRDYNVC traffic patterns showing high-frequency AUDIN open and close sequences from a single client

Monitoring Recommendations

Alert on FreeRDP server process restarts, coredumps, and abnormal exit codes
Track authenticated RDP sessions originating from unexpected source networks or user accounts
Log DRDYNVC channel lifecycle events where available and baseline normal AUDIN usage frequency per session

How to Mitigate CVE-2026-91947

Immediate Actions Required

Upgrade all FreeRDP server deployments to version 3.31.0 or later
Inventory applications and appliances that embed the FreeRDP server library and coordinate patching with upstream vendors
Restrict RDP server exposure to trusted networks and enforce strong authentication for all accounts able to reach the service

Patch Information

The FreeRDP project has addressed the flaw in release 3.31.0. The fix corrects lock scoping in the DRDYNVC parser so that the channel pointer is not dereferenced after the synchronization lock is released. Refer to the GitHub Security Advisory GHSA-6mpx-c8rj-whj5 for commit references and downstream distribution status.

Workarounds

Disable the AUDIN dynamic virtual channel on FreeRDP servers where audio input is not required
Limit DRDYNVC usage through server configuration to reduce exposure of the vulnerable parser path
Place FreeRDP servers behind an authenticated RDP gateway that restricts which client accounts can negotiate dynamic channels

bash

# Example: verify installed FreeRDP server version and confirm it is patched
freerdp-shadow-cli --version

# Upstream fix is in release 3.31.0 or later; upgrade via distribution package manager, for example:
# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade freerdp2-shadow-x11 freerdp3-shadow-x11

# Fedora/RHEL
sudo dnf upgrade freerdp