CVE-2026-91954: FreeRDP Null Pointer Dereference DOS Vulnerability

CVE-2026-91954 Overview

CVE-2026-91954 is a null pointer dereference vulnerability [CWE-476] in FreeRDP versions before 3.31.0. The flaw resides in the gdi_surface_bits function when the client processes Surface Bits commands referencing the NSCodec codec identifier. A malicious Remote Desktop Protocol (RDP) server can crash any connected FreeRDP client by sending a crafted Surface Bits command that claims to use NSCodec, even when the codec is explicitly disabled on the client side. Exploitation requires a user to initiate a connection to an attacker-controlled server, resulting in a denial-of-service condition against the client process.

Critical Impact
A malicious RDP server can remotely crash FreeRDP clients through crafted Surface Bits commands, disrupting remote session availability.

Affected Products

FreeRDP versions prior to 3.31.0
Applications and distributions embedding vulnerable FreeRDP libraries
Downstream RDP client software built on the FreeRDP codebase

Discovery Timeline

2026-09-15 - CVE-2026-91954 published to the National Vulnerability Database
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91954

Vulnerability Analysis

The vulnerability affects the FreeRDP client-side rendering pipeline that handles Surface Bits commands, a mechanism the RDP protocol uses to deliver bitmap surface updates. When a server sends a Surface Bits command declaring the NSCodec codec identifier, the gdi_surface_bits handler dereferences a codec context pointer without first verifying that the NSCodec context was initialized. Because NSCodec initialization is conditional on codec negotiation and configuration, clients that disabled NSCodec still reach the dereference path, producing an immediate process crash.

The result is a reliable client-side denial of service triggered by protocol traffic the client is otherwise willing to parse. No authentication is required on the server side; the attacker only needs to induce or accept a connection from the target client.

Root Cause

The root cause is missing validation of the NSCodec codec context pointer before use inside gdi_surface_bits. The handler trusts the codec identifier advertised in the Surface Bits command and proceeds to invoke decoding logic against an uninitialized or null structure. This is a classic [CWE-476] null pointer dereference where input-driven control flow reaches a code path that assumes prior initialization guaranteed by capability negotiation.

Attack Vector

Exploitation requires user interaction: the victim must connect to a malicious or compromised RDP server. Once the RDP session reaches the graphics update stage, the server sends a Surface Bits command with the NSCodec codec ID and crafted payload. The FreeRDP client dereferences the null pointer and terminates. Attack scenarios include phishing links containing .rdp files, RDP relay boxes on compromised infrastructure, and man-in-the-middle interception where an attacker substitutes a hostile server for a legitimate one.

No verified public exploit code is available. Technical details are documented in the FreeRDP GitHub Security Advisory and the VulnCheck Advisory for FreeRDP.

Detection Methods for CVE-2026-91954

Indicators of Compromise

Unexpected termination or crash of FreeRDP-based client processes such as xfreerdp or wlfreerdp shortly after establishing an RDP session
Core dumps or crash reports referencing gdi_surface_bits or NSCodec-related symbols in the stack trace
Outbound RDP connections (TCP/3389) to untrusted or newly registered destinations preceding client crashes

Detection Strategies

Inventory installed FreeRDP versions across workstations, jump hosts, and Linux desktops, and flag any build earlier than 3.31.0
Correlate application crash telemetry with preceding RDP session establishment events to identify server-triggered failures
Inspect RDP traffic metadata for connections to non-corporate destinations initiated by end users

Monitoring Recommendations

Forward endpoint process-exit and crash events into a central data lake for correlation with network telemetry
Alert on repeated FreeRDP client crashes originating from the same remote host, which may indicate targeted denial-of-service activity
Track deployment coverage of the patched FreeRDP 3.31.0 release across managed Linux and cross-platform endpoints

How to Mitigate CVE-2026-91954

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all affected systems
Rebuild and redistribute any downstream applications or container images that statically link FreeRDP
Restrict outbound RDP connectivity from user workstations to approved internal destinations only
Educate users about the risk of opening .rdp files or connecting to untrusted RDP servers

Patch Information

The FreeRDP project addressed the vulnerability in release 3.31.0 by adding proper validation of the NSCodec context before dereference inside gdi_surface_bits. Administrators should install the fixed version from official distribution repositories or the FreeRDP GitHub Security Advisory. Long-term support branches maintained by Linux distributions should be checked for backported fixes referencing GHSA-ffjr-p229-hpch.

Workarounds

Avoid connecting to untrusted RDP servers until the patch is deployed, as disabling NSCodec on the client does not prevent the crash
Enforce egress filtering on TCP/3389 and RDP over TLS to permit only vetted destinations
Use RDP gateways or bastion hosts that terminate sessions and inspect protocol traffic before it reaches vulnerable clients

bash

# Verify installed FreeRDP version and confirm it is 3.31.0 or later
xfreerdp --version

# Debian/Ubuntu example: update FreeRDP packages
sudo apt update && sudo apt install --only-upgrade freerdp2-x11 freerdp3-x11

# Fedora/RHEL example: update FreeRDP packages
sudo dnf upgrade freerdp