CVE-2026-91956: FreeRDP Buffer Overflow Vulnerability

CVE-2026-91956 Overview

CVE-2026-91956 is an out-of-bounds read vulnerability in FreeRDP versions prior to 3.31.0. The flaw resides in the func_get_ep_desc function within the URBDRC (USB Redirection) channel. The function indexes interface arrays by array position rather than by the protocol field InterfaceNumber. A malicious Remote Desktop Protocol (RDP) server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values. The client then reads past allocated heap memory and crashes. The issue is tracked as CWE-125 (Out-of-Bounds Read).

Critical Impact
A malicious RDP server can crash any FreeRDP client that connects with USB redirection enabled, causing denial of service and potential heap memory disclosure.

Affected Products

FreeRDP versions prior to 3.31.0
Applications and distributions bundling vulnerable FreeRDP builds
Deployments using the URBDRC channel for USB redirection

Discovery Timeline

2026-09-15 - CVE-2026-91956 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91956

Vulnerability Analysis

The vulnerability lives in the URBDRC channel implementation in FreeRDP, which handles USB device redirection between a client and an RDP server. When the server sends a SELECT_CONFIGURATION message, the client parses interface descriptors and calls func_get_ep_desc to retrieve endpoint descriptors for each interface. The function is expected to locate a descriptor whose InterfaceNumber field matches the requested value. Instead, the implementation uses the loop index as an array position. When a server supplies out-of-order or duplicated InterfaceNumber values, the mismatch drives reads past the bounds of the allocated interface array on the heap.

Successful exploitation crashes the client process. Depending on adjacent heap contents, the read may also expose sensitive memory before termination. The attack requires user interaction because the client must initiate a connection to the malicious server. See the GitHub Security Advisory for the maintainer analysis.

Root Cause

The root cause is an incorrect assumption that the ordinal position of an interface descriptor in the parsed array matches its protocol-level InterfaceNumber. The USB Device Framework allows these values to be permuted. Indexing by array position instead of searching by InterfaceNumber produces reads outside the allocated buffer whenever the server crafts non-monotonic values.

Attack Vector

Exploitation requires a victim to connect a vulnerable FreeRDP client to a server controlled by an attacker. Once the RDP session negotiates the URBDRC channel, the malicious server sends a SELECT_CONFIGURATION message with permuted InterfaceNumber fields. The client processes the message during device configuration and reads beyond the allocated interface array, terminating the session or the client process. No credentials on the target are required.

The vulnerability is described in the VulnCheck Advisory and the upstream GitHub Security Advisory.

Detection Methods for CVE-2026-91956

Indicators of Compromise

Unexpected crashes of xfreerdp, wlfreerdp, or embedded FreeRDP clients shortly after establishing an RDP session
Core dumps referencing func_get_ep_desc or the URBDRC channel module
RDP sessions to untrusted or newly observed hosts that terminate immediately after USB channel negotiation

Detection Strategies

Inventory endpoints and applications that ship or link against FreeRDP and flag versions below 3.31.0
Alert when FreeRDP client processes exit abnormally following outbound RDP connections on TCP/3389
Correlate crash telemetry with RDP session logs to identify servers that consistently trigger client termination

Monitoring Recommendations

Log outbound RDP connections from workstations and jump hosts, and compare destinations against approved server lists
Capture process crash events for RDP client binaries and forward them to a central SIEM for correlation
Monitor use of the URBDRC channel and restrict USB redirection where it is not required

How to Mitigate CVE-2026-91956

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later across all endpoints and dependent applications
Restrict outbound RDP connections to trusted, inventoried servers only
Disable USB redirection (URBDRC channel) on clients that do not require it

Patch Information

The FreeRDP project resolved the issue in version 3.31.0. The fix updates the URBDRC channel to locate endpoint descriptors by matching the InterfaceNumber field rather than indexing by array position. Downstream distributions and applications bundling FreeRDP should rebuild against the patched release. Refer to the GitHub Security Advisory GHSA-hg4r-vv53-vwf8 for commit-level detail.

Workarounds

Disable the URBDRC channel by omitting USB redirection command-line flags (for example, avoid /usb: on xfreerdp)
Only initiate RDP sessions to servers under organizational control until patching is complete
Segment jump hosts and administrator workstations to limit reachable RDP destinations

bash

# Configuration example: connect without enabling USB redirection
xfreerdp /v:rdp.example.internal /u:admin
# Verify the installed FreeRDP version is 3.31.0 or later
xfreerdp --version