CVE-2026-91961: FreeRDP before 3.31.0 Denial of Service via URBDRC
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
FreeRDP clients before 3.31.0 are exposed when they connect to a malicious RDP server capable of sending URBDRC control-transfer requests. The impact is termination of the client process, resulting in denial of service.
What does an attacker need to exploit it?
An attacker needs to operate or control an RDP server that the vulnerable FreeRDP client connects to. No client-side privileges are required, but user interaction is required because the client must initiate the connection.
How can I tell whether a client is affected?
A client is affected if it uses a FreeRDP version earlier than 3.31.0. During exploitation, the client process terminates after receiving a URBDRC control-transfer request with OutputBufferSize set to 65536.