CVE-2026-91961

FreeRDP versions before 3.31.0 contain a denial-of-service flaw (CWE-617, reachable assertion) in the URBDRC USB device redirection channel's control-transfer handling: the OutputBufferSize value is not validated before being passed to the libusb backend. A malicious or compromised RDP server can send a control-transfer request with OutputBufferSize set to 65536, which trips an assertion and immediately terminates the FreeRDP client process. The impact is limited to client availability (crash on connect) — there is no evidence of code execution or information disclosure, consistent with the CVSS 4.0 score of 7.1 with availability-only impact. Any user connecting to an untrusted server with a FreeRDP-based client that has USB redirection enabled is exposed, since the attack requires the client to initiate a connection (user interaction). No public proof-of-concept is known and there is no indication of exploitation in the wild.

What to do: Upgrade FreeRDP to 3.31.0 or later, or apply your distribution's or vendor's patched package if you use a FreeRDP-based client such as Remmina. As a mitigation, do not enable USB redirection (/usb, the URBDRC channel) when connecting to untrusted or unknown RDP servers. Investigate any client crashes occurring immediately upon connection to an unfamiliar server as a possible trigger of this bug.