CVE-2026-91946

Katalog CVE

CVSS 6.5 · Medium EPSS 0,53%

Kerentanan Use of Uninitialized Resource pada freerdp. Skor CVSS 3.1 6.5 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

FreeRDP versions before 3.31.0 contain an information disclosure vulnerability in the RDPGFX server's ResetGraphics PDU serializer that fails to initialize padding bytes in the fixed 340-byte wire format. Attackers can receive uninitialized heap memory including live pointers and GLib function addresses transmitted in the PDU, defeating heap ASLR and disclosing the GLib module base address.

Rincian

Terbit di NVD

15 September 2026

Terakhir diubah

24 September 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-908: Use of Uninitialized Resource

EPSS (30 hari)

0,53% peluang dieksploitasi; lebih tinggi dari 43,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-r7jx-j9h7-j4xj advisory vendor
• https://github.com/FreeRDP/FreeRDP/commit/483c9388119f06bac420d92053cff9ef94e83bea patch
• https://www.vulncheck.com/advisories/freerdp-before-3.31.0-information-disclosure-via-rdpgfx-resetgraphics patch · advisory pihak ketiga