CVE-2026-91957: FreeRDP Use-After-Free Vulnerability

CVE-2026-91957 Overview

CVE-2026-91957 is a use-after-free vulnerability [CWE-416] in FreeRDP versions before 3.31.0. The flaw resides in the smartcard Remote Desktop Protocol Device Redirection (RDPDR) device handler. When worker thread creation fails after device registration, the device pointer is deallocated while the device manager (devman) retains a reference to it. Attackers who can influence channel setup to trigger thread creation failure may cause a crash or, under narrow conditions, code execution in the FreeRDP client process.

Critical Impact
Exploitation requires a malicious or compromised RDP server, user interaction, and specific runtime conditions to induce thread creation failure, which limits practical impact to availability degradation in most scenarios.

Affected Products

FreeRDP versions prior to 3.31.0
FreeRDP clients with smartcard channel (RDPDR) enabled
Downstream distributions bundling vulnerable FreeRDP builds

Discovery Timeline

2026-09-15 - CVE-2026-91957 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91957

Vulnerability Analysis

The defect lives in the smartcard RDPDR device handler within FreeRDP. During channel initialization, the handler allocates a device object and registers it with the devman device manager. A worker thread is then created to service smartcard I/O requests from the RDP server. If thread creation fails after registration succeeds, the error path frees the device object but does not remove the corresponding entry from devman. The manager continues to hold a dangling pointer to freed memory.

Subsequent operations that iterate over registered devices, or that dispatch messages to the smartcard channel, dereference the stale pointer. This can produce a segmentation fault or, if the freed region is reallocated with attacker-influenced content, controlled memory corruption.

Root Cause

The root cause is inconsistent cleanup between the two related state machines. Device registration and worker thread creation are treated as independent operations rather than a single transactional unit. When only one succeeds, the error handler does not restore consistency across both.

Attack Vector

Exploitation requires a network-reachable RDP endpoint, active user interaction, and conditions under which CreateThread or the equivalent platform primitive fails. A malicious server can inflate the smartcard channel setup to increase pressure on thread creation, but reliable exploitation depends on host resource state. Attack complexity is high and privileges are not required on the client side.

No public proof-of-concept exploit is available. See the FreeRDP GitHub Security Advisory and the VulnCheck Security Advisory for the upstream technical details.

Detection Methods for CVE-2026-91957

Indicators of Compromise

Unexpected crashes of xfreerdp, wfreerdp, or embedded FreeRDP clients during RDP session establishment with smartcard redirection enabled
Core dumps or Windows Error Reporting events referencing the smartcard RDPDR channel handler
Repeated failed RDP session initializations against the same client host from an untrusted server

Detection Strategies

Inventory installed FreeRDP versions across endpoints and flag any build earlier than 3.31.0
Audit outbound RDP connections from workstations to servers outside trusted management ranges
Correlate FreeRDP process termination events with smartcard channel usage in application logs

Monitoring Recommendations

Alert on repeated abnormal terminations of FreeRDP client processes on user endpoints
Monitor RDP client egress to untrusted networks, particularly sessions negotiating the RDPDR channel
Track software inventory changes to confirm timely rollout of patched FreeRDP packages

How to Mitigate CVE-2026-91957

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all client systems
Rebuild and redeploy any third-party applications that statically link FreeRDP libraries
Restrict RDP client usage to trusted remote hosts until patching is verified

Patch Information

The FreeRDP project fixed the issue in release 3.31.0 by ensuring the device is removed from devman when worker thread creation fails. Consult the FreeRDP GitHub Security Advisory for commit references and the affected code paths.

Workarounds

Disable smartcard redirection on FreeRDP clients by omitting the /smartcard channel option
Enforce network policy to block outbound RDP connections to untrusted destinations
Limit RDP client execution to hosts where smartcard redirection is not required

bash

# Launch FreeRDP without smartcard redirection to avoid the vulnerable code path
xfreerdp /v:rdp.example.internal /u:alice /cert:tofu
# Do not append: /smartcard