CVE-2026-91951: FreeRDP DOS Vulnerability

CVE-2026-91951 Overview

CVE-2026-91951 is an out-of-bounds write vulnerability in FreeRDP versions prior to 3.31.0. The flaw resides in the urb_send_current_frame_number_result() function within the USB redirection (urbdrc) client channel. A malicious Remote Desktop Protocol (RDP) server can send a crafted 28-byte USB redirection message that triggers a 4-byte write past a 16-byte allocated buffer. When verbose asserts are enabled in the FreeRDP client build, this condition results in denial of service. Exploitation requires the victim to connect to an attacker-controlled RDP server, making user interaction a necessary precondition.

Critical Impact
A malicious RDP server can crash FreeRDP clients that use USB device redirection, disrupting remote desktop sessions for connected users.

Affected Products

FreeRDP versions 3.14.0 through 3.30.0
FreeRDP client builds with the urbdrc (USB redirection) channel enabled
Downstream distributions and applications embedding vulnerable FreeRDP releases

Discovery Timeline

2026-09-15 - CVE CVE-2026-91951 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91951

Vulnerability Analysis

The vulnerability affects the urb_send_current_frame_number_result() handler in the urbdrc client channel. This handler processes USB Request Block (URB) responses that report the current isochronous transfer frame number from a redirected USB device. FreeRDP allocates a 16-byte output buffer for the response payload but, under specific server-supplied input, writes 4 bytes beyond the allocated boundary. The mismatch stems from a 28-byte input message being processed without validating the size relationship between the incoming payload and the fixed output buffer. This behavior is categorized under [CWE-617: Reachable Assertion], reflecting that verbose assert builds convert the memory safety violation into a fatal client termination.

Root Cause

The root cause is missing length validation between the server-controlled URB message size and the statically sized 16-byte output buffer. The urb_send_current_frame_number_result() function writes response data without confirming that the target buffer can accommodate the calculated payload length. When the message triggers the extra 4-byte write, the boundary violation either corrupts adjacent memory or, in assert-enabled builds, aborts the client process.

Attack Vector

An attacker operates a malicious or compromised RDP server. When a FreeRDP client connects and negotiates USB redirection through the urbdrc channel, the server sends a crafted 28-byte URB message referencing the current frame number result. The FreeRDP client processes the message and performs the out-of-bounds write. Exploitation requires the user to initiate an outbound RDP session to the attacker-controlled server, satisfying the user interaction requirement in the CVSS vector. Network reachability and USB redirection support are the only additional prerequisites.

No verified proof-of-concept code is publicly available. Technical details are described in the FreeRDP GitHub Security Advisory and the VulnCheck Advisory on FreeRDP.

Detection Methods for CVE-2026-91951

Indicators of Compromise

Unexpected FreeRDP client crashes or abort signals during active RDP sessions using USB redirection
Client-side core dumps referencing urb_send_current_frame_number_result or the urbdrc channel
Outbound RDP (TCP/3389) sessions to unfamiliar or newly observed external hosts followed by immediate client termination

Detection Strategies

Inventory endpoints running FreeRDP and identify installed versions to flag anything below 3.31.0
Correlate process termination events for xfreerdp, wlfreerdp, or embedded FreeRDP consumers with recent outbound RDP connections
Alert on RDP sessions to non-corporate destinations from workstations that have USB redirection enabled

Monitoring Recommendations

Collect and centralize application crash telemetry from Linux, macOS, and Windows endpoints running FreeRDP
Monitor network flows for outbound TCP/3389 connections and enforce allowlists for approved RDP targets
Track deployment of FreeRDP updates across managed hosts to confirm remediation coverage

How to Mitigate CVE-2026-91951

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all client systems and embedded applications
Restrict outbound RDP connections to trusted, known-good servers using host and network firewall policies
Advise users to avoid initiating RDP sessions to untrusted or externally hosted RDP endpoints

Patch Information

The FreeRDP project fixed the out-of-bounds write in release 3.31.0. Refer to the FreeRDP GitHub Security Advisory GHSA-h5w2-q35j-443h for commit references and downstream distribution guidance. Package maintainers for Linux distributions and applications bundling FreeRDP should rebuild against the patched release.

Workarounds

Disable USB device redirection in FreeRDP client invocations where the urbdrc channel is not required
Limit RDP connections to internally managed servers where server behavior can be trusted
Segment users who require USB redirection into controlled network zones with strict egress filtering

bash

# Invoke FreeRDP without the URB device redirection channel
xfreerdp /v:rdp.internal.example.com /u:analyst \
  -usb \
  /cert:tofu