CVE-2026-91961: FreeRDP URBDRC Denial-of-Service Vulnerability

CVE-2026-91961 Overview

CVE-2026-91961 is a denial-of-service vulnerability in FreeRDP versions prior to 3.31.0. The flaw exists in the URBDRC (USB Redirection) channel's control-transfer request path. FreeRDP fails to validate the OutputBufferSize field before forwarding the request to the libusb backend. A malicious Remote Desktop Protocol (RDP) server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the FreeRDP client process. The vulnerability is tracked under [CWE-617: Reachable Assertion].

Critical Impact
A malicious RDP server can crash any FreeRDP client that connects to it and has USB redirection enabled, disrupting remote desktop sessions.

Affected Products

FreeRDP versions before 3.31.0
FreeRDP clients with URBDRC (USB redirection) channel enabled
Downstream distributions and applications that embed vulnerable FreeRDP libraries

Discovery Timeline

2026-09-15 - CVE-2026-91961 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-91961

Vulnerability Analysis

The vulnerability resides in FreeRDP's URBDRC channel, which implements USB device redirection over RDP. When the server sends a control-transfer USB Request Block (URB), the client parses the request and forwards it to the local libusb backend to interact with a redirected USB device.

The client-side code does not validate the OutputBufferSize value received from the server before passing it to libusb. When OutputBufferSize reaches 65536, an assertion in the transfer-handling path evaluates to false and aborts the process. Because the server controls the value directly, any connected client can be terminated on demand.

Root Cause

The root cause is missing input validation on server-supplied protocol fields. The URBDRC control-transfer handler trusts OutputBufferSize without bounding it against the maximum size supported by the backend. This constitutes a reachable assertion [CWE-617], where attacker-controlled data reaches an assert() condition that terminates the process instead of returning a protocol error.

Attack Vector

Exploitation requires a victim to initiate an RDP session to an attacker-controlled or compromised RDP server with USB redirection enabled. This aligns with the user-interaction requirement in the CVSS vector. Once the session is established, the server sends a crafted URBDRC control-transfer request with OutputBufferSize=65536. The FreeRDP client hits the assertion and terminates, ending the session and any dependent workflows.

No authentication to the client is required, and no memory corruption or code execution occurs. The impact is limited to availability. See the FreeRDP GitHub Security Advisory and the VulnCheck Advisory for FreeRDP for protocol-level details.

Detection Methods for CVE-2026-91961

Indicators of Compromise

Unexpected termination of FreeRDP client processes (xfreerdp, wlfreerdp, or embedded FreeRDP-based clients) shortly after connecting to a remote server.
Assertion failure messages in FreeRDP client logs referencing the URBDRC channel or control-transfer handling.
RDP sessions dropping immediately after USB redirection negotiation completes.

Detection Strategies

Inventory endpoints running FreeRDP and identify installations older than version 3.31.0.
Monitor process crash telemetry for FreeRDP binaries and correlate with recent outbound RDP connections.
Flag outbound RDP connections to untrusted or newly observed destinations, especially where USB redirection is enabled by policy.

Monitoring Recommendations

Collect FreeRDP client stderr and syslog output centrally to capture assertion failure traces.
Alert on repeated FreeRDP crashes across multiple hosts, which may indicate a shared malicious server.
Track RDP session duration; sessions that terminate within seconds of connect are candidates for review.

How to Mitigate CVE-2026-91961

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on all client systems.
Audit downstream applications and Linux distribution packages that bundle FreeRDP and apply vendor updates as they become available.
Restrict outbound RDP connections to a known allowlist of trusted servers.

Patch Information

The fix is included in FreeRDP 3.31.0, which adds validation of the OutputBufferSize field in the URBDRC control-transfer path before the request is dispatched to libusb. Refer to the FreeRDP GitHub Security Advisory GHSA-w9qg-g24r-77f6 for the commit references and affected code paths.

Workarounds

Disable the URBDRC channel by omitting the /usb command-line option or removing USB redirection from client configuration.
Only connect to RDP servers under organizational control until patched builds are deployed.
Enforce network-level controls that prevent FreeRDP clients from reaching untrusted RDP endpoints.

bash

# Disable USB redirection when launching xfreerdp (do not pass /usb)
xfreerdp /v:trusted-server.example.com /u:user /cert:tofu

# Verify installed FreeRDP version is 3.31.0 or later
xfreerdp --version