Executive brief
FreeRDP is an open-source remote desktop client used to connect to Windows and other RDP servers. A malicious RDP server can force the client to leak uninitialized memory containing system addresses, which defeats address space randomization (ASLR) protections. When chained with other memory corruption vulnerabilities, this could enable an attacker to achieve complete remote code execution on the client system.
Technical details
FreeRDP's urbdrc USB redirection channel contains an uninitialized heap memory disclosure vulnerability in the urb_write_completion function (channels/urbdrc/client/data_transfer.c). When handling USB transfer completions, the code reserves OutputBufferSize bytes using Stream_Seek without initializing or zeroing the memory. If a USB transfer fails or returns fewer bytes than expected, this uninitialized heap space is sent back to the RDP server containing live heap and library pointers. A malicious RDP server can trigger failing USB transfers to leak tens of kilobytes of client memory, enabling ASLR bypass. The attack requires USB redirection to be active (xfreerdp /usb: or Remmina with usb profile option) and affects FreeRDP 2.0.0 through 3.30.0. The vulnerability is patched in FreeRDP 3.31.0.
Affected products
- FreeRDP FreeRDP 2.0.0 through 3.30.0
- Remmina Remmina 1.4.x
Timeline
- 2026-09-01: disclosed
- 2026-09-15: advisory: CVE-2026-91963 published
- 2026-09-15: patched: FreeRDP 3.31.0 contains fix