CVE-2026-27951 - Vulnerability Analysis
MediumCVSS: 5.3Last Updated: February 27, 2026
FreeRDP - Denial of Service
Published: February 25, 2026Updated: February 27, 2026PoC AvailableRemote Exploitable
Overview
FreeRDP < 3.23.0 contains a denial of service caused by an endless blocking loop in the Stream_EnsureCapacity function, letting attackers cause service disruption, exploit requires 32-bit system with physical memory >= SIZE_MAX.
Severity & Score
Severity: Medium
CVSS Score: 5.3
Impact
Attackers can cause a denial of service by triggering an endless blocking loop, disrupting client or server availability.
Mitigation
Update to version 3.23.0 or later.
References
Related Resources
Details
- CVE ID
- CVE-2026-27951
- Severity
- Medium
- CVSS Score
- 5.3
- Type
- denial_of_service
- Status
- confirmed
CWE
- CWE-190
CVSS Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L