CVE-2026-91956

FreeRDP before 3.31.0 contains an out-of-bounds read (CWE-125) in the URBDRC (USB redirection) channel's func_get_ep_desc function, which indexes interface arrays by loop position rather than by the protocol-supplied InterfaceNumber field. A malicious or compromised RDP server can trigger the flaw by sending a crafted SELECT_CONFIGURATION message containing permuted InterfaceNumber values, causing the client to read past the end of allocated heap memory. The primary impact is denial of service against the connecting client, since the malformed access can crash the process; CVSS 4.0 rates it 7.1 (high) with high availability impact and no confidentiality or integrity impact. Any user of an affected FreeRDP-based client (such as xfreerdp or clients embedding the library) who connects to an attacker-controlled server is at risk, which is reflected in the UI:P (user interaction required) scoring metric. No public proof-of-concept is known and the flaw is not listed in CISA's KEV catalog, so exploitation in the wild is not currently indicated.

What to do: Upgrade FreeRDP to version 3.31.0 or later as soon as a patched package is available from your distribution or vendor. As an interim mitigation, disable USB device redirection (the URBDRC channel, e.g., the /usb option or equivalent GUI setting) and avoid connecting to untrusted or unknown RDP servers. Administrators should inventory embedded products that bundle FreeRDP and verify whether the vendor has shipped a backported fix.