Executive brief
FreeRDP is an open-source RDP client library that allows systems to connect to Windows-based remote desktops. A malicious RDP server can trigger a denial-of-service attack by sending a specially crafted request with an oversized buffer parameter, causing the client process to terminate unexpectedly. This disrupts remote desktop connections and could be used to deny access to corporate resources.
Technical details
The vulnerability is a reachable assertion (CWE-617) in the URBDRC (USB Redirection) control-transfer request path. The affected component fails to validate OutputBufferSize before passing it to the libusb backend; an attacker-controlled RDP server can send a control-transfer request with OutputBufferSize=65536 (exceeding UINT16_MAX), which triggers a WINPR_ASSERT in libusb_udevice.c:1324, deterministically terminating the client process. The attack requires a network vector (RDP connection) and user interaction (connecting to a server), but is otherwise unauthenticated. The fix, available in FreeRDP 3.31.0+, rejects or clamps oversized OutputBufferSize values before the libusb backend is invoked.
Affected products
- FreeRDP FreeRDP before 3.31.0
Timeline
- 2026-08-31: disclosed: GitHub Security Advisory GHSA-w9qg-g24r-77f6 published
- 2026-09-15: advisory: CVE-2026-91961 published on NVD
- 2026: patched: Fixed in FreeRDP 3.31.0