CVE-2026-91951

FreeRDP versions before 3.31.0 contain an out-of-bounds write in the urbdrc USB redirection client channel, specifically in the urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message that triggers a 4-byte write past an allocated 16-byte buffer when a victim client connects with USB redirection enabled. The impact is denial of service — the client crashes when verbose asserts are enabled (CWE-617 reachable assertion) — with no confidentiality or integrity impact per the CVSS vector, which also requires user interaction since the victim must initiate the connection to the attacker's server. Anyone running an FreeRDP-based client (such as xfreerdp/sdl-freerdp) older than 3.31.0 with USB redirection active is affected, and the libfreerdp library is bundled into third-party products that inherit the flaw until they ship an updated build. No public proof of concept exists, the issue is not in CISA's KEV catalog, and no exploitation has been observed.

What to do: Upgrade to FreeRDP 3.31.0 or later, or apply your distribution's backported patch. Avoid enabling USB redirection (/usb:...) when connecting to untrusted or unknown RDP servers, since exploitation requires the victim to connect to a malicious server. If your product bundles libfreerdp, rebuild against the fixed version and push an update to downstream users.