CVE-2026-91954
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 15, 2026
Vendor
unknown
Description
FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.