CVE-2026-91963: FreeRDP USB Redirection RCE Vulnerability

CVE-2026-91963 Overview

CVE-2026-91963 is an uninitialized heap memory disclosure vulnerability in FreeRDP, an open-source implementation of the Remote Desktop Protocol (RDP). The flaw resides in the urbdrc USB redirection channel and affects FreeRDP versions before 3.31.0. A malicious RDP server can induce failing USB transfers to force the client to return uninitialized heap memory. The disclosed memory can leak pointers and defeat Address Space Layout Randomization (ASLR). When chained with a memory corruption primitive, this weakness enables remote code execution on the connecting client. The issue is categorized as CWE-457 (Use of Uninitialized Variable).

Critical Impact
A hostile RDP server can read uninitialized heap memory from any FreeRDP client that connects with USB redirection enabled, defeating ASLR and enabling reliable exploitation of memory corruption bugs.

Affected Products

FreeRDP versions 2.0.0 through 3.30.0
Downstream projects and distributions that bundle vulnerable FreeRDP libraries
Applications using the urbdrc USB redirection channel over RDP

Discovery Timeline

2026-09-15 - CVE-2026-91963 published to the National Vulnerability Database
2026-09-16 - Record last modified in NVD

Technical Details for CVE-2026-91963

Vulnerability Analysis

The vulnerability lives in the urbdrc (USB Request Block Device Redirect Channel) client implementation used by FreeRDP to forward USB devices from the client to the remote session. When a USB transfer request from the server fails, the client returns response buffers to the server without first zeroing or fully initializing them. Those buffers are allocated from the process heap and frequently contain residual data from prior allocations, including function pointers, heap metadata, and library base offsets.

Exploitation requires user interaction: a user must initiate an RDP connection to an attacker-controlled server. Once connected, the server can repeatedly trigger the failing transfer path to sample heap contents and reconstruct address layouts. The disclosure primitive alone does not execute code, but it removes the ASLR barrier that protects other memory corruption vulnerabilities in the same client.

Root Cause

The root cause is missing initialization of response buffers on the error path within the urbdrc channel handler. Under [CWE-457], the code path allocates memory, populates fields only on the success branch, and then transmits the buffer regardless of outcome. Attacker-controlled parameters on the failing transfer determine which bytes of the heap are returned.

Attack Vector

The attack requires the victim to establish an RDP session to a malicious server with USB redirection enabled on the client. This is a common configuration for administrators who redirect smart cards, security keys, or removable media into remote sessions. No authentication to the client is required, and the server operator controls both the USB request stream and the failure conditions. Refer to the FreeRDP GHSA-hw7p-5h2r-83gq advisory and the VulnCheck advisory on FreeRDP urbdrc disclosure for protocol-level details.

Detection Methods for CVE-2026-91963

Indicators of Compromise

Outbound RDP sessions from workstations or jump hosts to untrusted or newly registered external IP addresses on TCP/3389.
FreeRDP client processes (xfreerdp, wlfreerdp, sdl-freerdp) loading the urbdrc channel against non-corporate destinations.
Anomalous volumes of failed USB Request Block responses within a single RDP session.
Client crashes or memory corruption alerts immediately following RDP sessions to unknown servers.

Detection Strategies

Inventory installed FreeRDP versions across Linux, macOS, and embedded fleets and flag any build below 3.31.0.
Inspect RDP channel negotiations for the URBDRC static virtual channel when connecting to external destinations.
Alert on FreeRDP client processes spawning shells or writing to autostart locations after an outbound RDP session.

Monitoring Recommendations

Log all outbound RDP connections at the network egress and correlate destinations against threat intelligence for hostile RDP infrastructure.
Monitor for repeated USB transfer failures within a single session, which is atypical for benign redirection.
Track package inventory events for freerdp2, freerdp3, and libfreerdp to confirm remediation coverage.

How to Mitigate CVE-2026-91963

Immediate Actions Required

Upgrade FreeRDP to version 3.31.0 or later on every endpoint that runs an RDP client based on the library.
Disable USB redirection on FreeRDP clients that do not require it by omitting the /usb command-line option.
Restrict outbound RDP egress from workstations to a defined list of trusted internal and vendor endpoints.
Instruct administrators and users to avoid initiating RDP sessions to unverified servers until patching is complete.

Patch Information

The FreeRDP maintainers released the fix in version 3.31.0. The patch initializes response buffers on the USB transfer error path within the urbdrc channel so that no residual heap data is returned to the server. Details are published in the FreeRDP security advisory GHSA-hw7p-5h2r-83gq. Downstream Linux distributions should ship the corresponding backported packages; verify with the distribution's security tracker.

Workarounds

Launch FreeRDP without the /usb flag to prevent the urbdrc channel from loading.
Block or proxy outbound TCP/3389 and TCP/3388 at the perimeter for hosts that do not require external RDP.
Enforce allow-lists of approved RDP destinations through host-based firewalls or zero trust network access policies.

bash

# Example: launch xfreerdp without USB redirection to avoid the urbdrc channel
xfreerdp /v:rdp.example.internal /u:alice /cert:tofu

# Verify the installed FreeRDP version meets or exceeds the fixed release
xfreerdp --version | awk '{print $NF}'

# Debian/Ubuntu: confirm patched package
apt-cache policy freerdp2-x11 freerdp3-x11