Vulnerability Details CVE-2026-91954
FreeRDP before 3.31.0 contains a null pointer dereference vulnerability in gdi_surface_bits when processing Surface Bits commands with NSCodec codec ID. A malicious RDP server can crash a FreeRDP client by sending a crafted Surface Bits command claiming to use NSCodec, even when the codec is disabled.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 28.2%
CVSS Severity
CVSS v3 Score 6.5