Executive brief
FreeRDP is a popular open-source client for connecting to remote Windows desktops via RDP protocol with USB device redirection. A malicious RDP server can send a specially crafted message to trigger a buffer overflow in the USB redirection handler, causing the client to crash (denial of service) or potentially corrupt memory. This affects users who explicitly enable USB device forwarding, which is disabled by default.
Technical details
The vulnerability is an out-of-bounds write in the urb_send_current_frame_number_result() function within channels/urbdrc/client/data_transfer.c. The root cause is a missing buffer size check: the function receives a 16-byte heap buffer but writes 4 additional bytes at offset 16 without first growing the buffer. A network-reachable malicious RDP server can trigger this by sending a crafted 28-byte USB redirection message. On default builds with verbose asserts enabled, this causes immediate denial of service via abort(). On builds with asserts disabled, the 4-byte write (containing the constant value 12) lands in heap allocator slack or neighbor blocks, potentially corrupting memory. USB redirection must be explicitly enabled client-side, limiting exposure. Patched in FreeRDP 3.31.0.
Affected products
- FreeRDP FreeRDP 3.14.0 through 3.30.0
Timeline
- 2026-09-15: disclosed: CVE-2026-91951 published on NVD
- 2026-09-01: advisory: GitHub Security Advisory GHSA-h5w2-q35j-443h published
- 2026: patched: Fixed in FreeRDP 3.31.0