What is GHSA-chpg-x28q-pmrg?

GHSA-chpg-x28q-pmrg is a security advisory published by GitHub Security Advisories with High severity. FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC...

Which CVE IDs does GHSA-chpg-x28q-pmrg cover?

GHSA-chpg-x28q-pmrg covers the following CVE IDs: CVE-2026-91947. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-chpg-x28q-pmrg?

GHSA-chpg-x28q-pmrg has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-chpg-x28q-pmrgHighCVSS 7.5

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC...

Vendor

GitHub Security Advisories

Published

September 15, 2026

Last Modified

September 15, 2026

🔗 CVE IDs covered (1)

CVE-2026-91947 →

📋 Description

FreeRDP server versions before 3.31.0 contain a use-after-free vulnerability in the DRDYNVC parser that dereferences a channel pointer after releasing the synchronization lock. Authenticated clients can race AUDIN channel closure messages against DRDYNVC data parsing to trigger heap-use-after-free when accessing freed channel objects.

🔗 References (4)

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-6mpx-c8rj-whj5
https://nvd.nist.gov/vuln/detail/CVE-2026-91947
https://www.vulncheck.com/advisories/freerdp-server-before-3.31.0-use-after-free-via-drdynvc
https://github.com/advisories/GHSA-chpg-x28q-pmrg