CVE-2026-91946

Executive Summary

CVE-2026-91946 is an information disclosure vulnerability in FreeRDP versions before 3.31.0, affecting the RDPGFX server's ResetGraphics PDU serializer. The serializer fails to initialize padding bytes within a fixed 340-byte wire format, causing uninitialized heap memory — including live pointers and GLib function addresses — to be transmitted to remote clients. With a CVSS score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), this flaw defeats heap ASLR and discloses the GLib module base address, providing attackers with critical memory layout information that can be leveraged to bypass exploit mitigations in subsequent attacks.

Technical Analysis

The vulnerability resides in FreeRDP's RDPGFX (Remote Desktop Protocol Graphics Pipeline Extension) server implementation, specifically within the serializer for the ResetGraphics PDU. The RDPGFX protocol defines a fixed 340-byte wire format for ResetGraphics messages. When FreeRDP serializes this structure, padding bytes between fields are not explicitly initialized before transmission.

This creates a classic CWE-908 (Use of Uninitialized Resource) condition. The heap memory allocated for the 340-byte buffer may contain residual data from previously freed allocations. Because the uninitialized padding is transmitted verbatim to the connecting RDP client, an attacker can capture whatever heap contents happen to occupy those bytes at serialization time.

The disclosure specifically leaks heap pointers and GLib function addresses. GLib is a foundational C library used extensively by FreeRDP for data structures, memory management, and event loops. By leaking a GLib function address, an attacker learns the base address of the GLib shared library as loaded in the server process. Combined with leaked heap pointers, this defeats heap ASLR — a critical prerequisite for reliable exploitation of memory corruption vulnerabilities.

The attack surface is the RDPGFX virtual channel, enabled by default in modern FreeRDP server deployments. The vulnerability is remotely triggerable over the network (AV:N) with low privileges (PR:L) and requires no user interaction (UI:N). The confidentiality impact is high (C:H) because it discloses sensitive memory layout information, while integrity and availability impacts are none (I:N/A:N).

The 340-byte fixed wire format means the padding bytes are consistently present in every ResetGraphics PDU transmission, making the leak reliable and repeatable. Each connection or PDU transmission may leak different heap contents depending on allocator state, allowing an attacker to potentially reconstruct a detailed memory map through repeated observations.

Insufficient technical detail is available regarding exact function names, memory allocation patterns, or the precise offset of the uninitialized padding within the 340-byte structure. The NVD description does not specify which padding fields are affected or whether the leak occurs on every ResetGraphics PDU or only under specific conditions.

Exploitation Scenarios

No public PoC is available. The attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance/Target Identification: An attacker identifies a FreeRDP-based RDP server (e.g., xrdp, GNOME Remote Desktop, or custom FreeRDP server deployments) exposing port 3389. Version fingerprinting determines whether FreeRDP < 3.31.0 is in use. The attacker requires valid low-privileged credentials (PR:L) to establish an RDP session.

2. Triggering the Flaw: After authenticating and negotiating the RDPGFX virtual channel, the attacker causes the server to send a ResetGraphics PDU. In RDPGFX, ResetGraphics is typically sent during session initialization or display reconfiguration. The attacker may trigger it by connecting, resizing the display, or performing actions that prompt display parameter changes. The server serializes the 340-byte ResetGraphics message, including uninitialized padding bytes drawn from heap memory.

3. Payload/Execution Method: The attacker captures the ResetGraphics PDU from the network stream. No special payload is required — the vulnerability is triggered by normal protocol interaction. The attacker extracts the padding bytes from the PDU, which contain raw heap memory. By parsing these bytes, the attacker identifies pointer values and GLib function addresses. Repeated session establishment or display reconfiguration may yield multiple samples to increase reliability and leak diversity.

4. Post-Exploitation Impact: The leaked GLib base address and heap pointers defeat ASLR protections. This information is not directly exploitable for code execution but serves as a critical primitive for chaining with other vulnerabilities. An attacker who has identified a separate memory corruption flaw in FreeRDP or the host RDP stack can use the leaked addresses to construct reliable exploits (e.g., ROP chains, heap grooming) that bypass ASLR. The information disclosure alone may also reveal other sensitive heap contents such as session tokens, cryptographic material, or internal data structures depending on what occupies the heap at transmission time.

Impact Assessment

The CVSS v3.1 score of 6.5 (Medium) reflects a high confidentiality impact (C:H) from uninitialized memory disclosure, with no integrity (I:N) or availability (A:N) impact. The network attack vector (AV:N) and low privileges required (PR:L) indicate that any authenticated RDP user can trigger the leak. No user interaction (UI:N) is needed.

Affected systems include any server application embedding FreeRDP < 3.31.0 with the RDPGFX channel enabled. This encompasses Linux/Unix RDP servers built on FreeRDP, including xrdp (if built against affected FreeRDP), GNOME Remote Desktop, and custom or embedded RDP server implementations in appliances, kiosks, and VDI infrastructure. The blast radius is significant in environments where FreeRDP serves as the RDP server component, as every authenticated session is a potential leak vector.

The primary business impact is the undermining of ASLR as a defense-in-depth mechanism. While this vulnerability alone does not permit code execution or data modification, it provides attackers with the memory layout information necessary to weaponize other vulnerabilities. In multi-tenant or high-security environments, the disclosure of heap contents could also directly leak sensitive data (credentials, session identifiers) depending on heap reuse patterns. The low EPSS score (0.00427, 36.3rd percentile) suggests limited current exploitation activity, but the vulnerability's role as an exploit primitive elevates its strategic importance.

Detection Guidance

Sigma Rule

title: FreeRDP RDPGFX ResetGraphics PDU Uninitialized Memory Disclosure
id: 8f4a2c1e-9b3d-4e7a-a1c2-5d6f8e9b0c3a
status: experimental
description: Detects potential exploitation of CVE-2026-91946 via anomalous RDPGFX ResetGraphics PDU activity from FreeRDP servers
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-91946
author: valtersit.com
date: 2026/01/01
tags:
    - attack.t1592
logsource:
    category: network_connection
    product: zeek
detection:
    selection:
        id.resp_p: 3389
        proto: tcp
    timeframe: 5m
    condition: selection | count() by id.orig_h > 50
falsepositives:
    - Legitimate RDP session reconnections
    - Display resize operations by legitimate users
level: low

YARA Rule

rule CVE_2026_91946_FreeRDP_ResetGraphics_Leak
{
    meta:
        description = "Detects FreeRDP ResetGraphics PDU with uninitialized padding leak indicators"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91946"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $rdpgfx_hdr = { 14 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? }
        $reset_graphics = { 0A 00 }
        $glib_ptr = { 7F ?? ?? ?? ?? ?? ?? ?? }

    condition:
        $rdpgfx_hdr at 0 and $reset_graphics and #glib_ptr > 2
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 3389 (msg:"CVE-2026-91946 FreeRDP RDPGFX ResetGraphics Uninitialized Memory Disclosure Attempt"; flow:established,to_server; content:"|14 00|"; offset:0; depth:2; content:"|0A 00|"; distance:0; within:340; threshold:type threshold, track by_src, count 10, seconds 60; classtype:attempted-recon; reference:cve,2026-91946; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91946; sid:202691946; rev:1;)

Elastic Detection

network where network.transport == "tcp" and destination.port == 3389 and
  event.action == "connection_attempted" and
  process.name in ("freerdp", "xfreerdp", "xrdp", "gnome-remote-desktop")

Splunk SPL Query

index=network sourcetype=firewall OR sourcetype=zeek_conn
| search dest_port=3389
| stats count dc(src_ip) as unique_sources by dest_ip
| where count > 100
| eval cve="CVE-2026-91946"
| eval description="Potential FreeRDP RDPGFX ResetGraphics uninitialized memory disclosure - high volume RDP connections"
| table dest_ip, count, unique_sources, cve, description

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91946,">
  <rule id="100946" level="6">
    <decoded_as>json</decoded_as>
    <field name="destination.port">3389</field>
    <field name="network.transport">tcp</field>
    <description>CVE-2026-91946: Potential FreeRDP RDPGFX ResetGraphics uninitialized memory disclosure - RDP connection to vulnerable server</description>
    <mitre>
      <id>T1592</id>
    </mitre>
    <group>vulnerability_detection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate Mitigations:

   • Disable the RDPGFX virtual channel if not required for functionality. In FreeRDP server configurations, this may be controlled through RDP protocol negotiation settings or by limiting display features that trigger ResetGraphics PDUs.
   • Restrict network access to RDP services (port 3389) using firewall rules, VPNs, or jump hosts. Limit to trusted source IPs only.
   • Enforce strong authentication and monitor for anomalous RDP session establishment patterns.
   • Where possible, run FreeRDP server processes with minimal privileges and in sandboxed/containerized environments to limit what heap contents may be leaked.

2. Patch/Upgrade Steps:

   • Upgrade FreeRDP to version 3.31.0 or later. OSV is the single source claiming this fix; verify the patch independently before relying on it for remediation.
   • If distributing FreeRDP as a dependency of another application (e.g., xrdp, GNOME Remote Desktop), update the bundled FreeRDP library and rebuild the parent application.
   • Reboot or restart all RDP server services after applying the update to ensure the patched binary is loaded.
   • Verify the installed version post-upgrade using the package manager or binary version query.

3. Long-Term Hardening:

   • Adopt memory-safe serialization practices: explicitly zero-initialize all wire-format buffers, particularly padding fields, before transmission (e.g., use calloc instead of malloc, or memset the buffer).
   • Implement compiler-level and runtime defenses: enable ASLR fully, use stack canaries, and consider control-flow integrity (CFI) to reduce the impact of memory disclosure primitives.
   • Conduct regular security audits of all protocol PDU serializers for uninitialized memory patterns, especially in fixed-size structures with padding.
   • Monitor FreeRDP security advisories and subscribe to vendor notification channels for prompt patching of future vulnerabilities.
   • Deploy network-level detection (as provided in Detection Guidance) to alert on anomalous RDPGFX traffic patterns that may indicate reconnaissance.

References

1. NVD — CVE-2026-91946: https://nvd.nist.gov/vuln/detail/CVE-2026-91946
2. FreeRDP Project: https://www.freerdp.com/
3. OSV — Package advisory for FreeRDP: https://osv.dev/
4. MITRE ATT&CK T1592 — Gather Victim Host Information: https://attack.mitre.org/techniques/T1592/
5. CWE-908 — Use of Uninitialized Resource: https://cwe.mitre.org/data/definitions/908.html

Threat Actor/Exploit-in-the-Wild Evidence: None. CISA KEV status is NO. No public PoC or exploit code is known. EPSS score is 0.00427 (36.3rd percentile), indicating low predicted exploitation activity at this time.