CVE-2026-91963
MEDIUMCVSS 6.5Description
FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.
Timeline
Published:September 15th, 2026 4:17 PM
Last modified:September 23rd, 2026 8:08 PM
CVSS Scoring
CVSS v3: 6.5 (MEDIUM)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Affected Software
From NVD CPE configuration data
Vendors
freerdp
Products
freerdp
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gqVendor Advisory
- https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrcThird Party Advisory
- https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gqVendor Advisory
Source: NIST NVD · Data may lag official sources by up to one minute