CVE-2026-91951: FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urbsendcurrentframenumberresult() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denial of service when verbose asserts are enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
FreeRDP urbdrc client channelto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Frequently Asked Questions
Which deployments are exposed to a malicious server?
FreeRDP versions 3.14.0 through 3.30.0 are affected when acting as an RDP client using the urbdrc client channel. The attack is delivered by a malicious RDP server.
What does exploitation require?
An attacker needs to operate or control an RDP server that the user connects to and send a crafted 28-byte USB redirection message. The vector requires user interaction because a user must initiate the connection.
What is the observed impact?
The crafted message causes a 4-byte write beyond an allocated 16-byte buffer. The described outcome is denial of service when verbose asserts are enabled.
What version resolves the issue?
Versions before 3.31.0 are vulnerable, so upgrading to FreeRDP 3.31.0 or later addresses the affected version range.