Executive brief
FreeRDP is a popular open-source client for connecting to Windows Remote Desktop servers. A malicious or compromised RDP server can send specially crafted USB device redirection messages to trigger a memory read error that crashes the FreeRDP client, causing a denial of service. This affects users relying on FreeRDP for remote desktop access to conduct their work.
Technical details
FreeRDP's URBDRC (USB device redirection) channel contains a heap out-of-bounds read (CWE-125) in func_get_ep_desc() caused by a subscript-semantics mismatch. The validation function libusb_udev_complete_msconfig_setup() indexes interface arrays by the protocol field InterfaceNumber, while func_get_ep_desc() indexes by array position (inum). When a malicious RDP server sends a SELECT_CONFIGURATION message with permuted InterfaceNumber values, the validator checks one interface while the reader accesses a different interface. Additionally, AlternateSetting is used as an unguarded subscript into altsetting[] without bounds checking against num_altsetting. An attacker can trigger an out-of-bounds read that dereferences a garbage pointer, crashing the client. FreeRDP 3.31.0 and later contain a fix.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-09-15: disclosed
- 2026-09-15: patched: FreeRDP 3.31.0