CVE-2026-91963

FreeRDP versions before 3.31.0 disclose uninitialized heap memory via the urbdrc USB redirection channel (CWE-457). A malicious or compromised RDP server triggers failing USB transfer requests that cause the client to send back uninitialized heap contents. The leaked data can disclose heap addresses, defeating ASLR and enabling reliable remote code execution when chained with a memory corruption vulnerability. Any user of a FreeRDP-based client on a version before 3.31.0 who connects to an attacker-controlled server with USB redirection active is affected. No public proof-of-concept exists and the flaw is not listed in CISA's KEV catalog, so exploitation is not known to be occurring in the wild.

What to do: Upgrade FreeRDP to version 3.31.0 or later as soon as patched builds are available. If immediate upgrade is not possible, disable USB redirection entirely (do not enable the urbdrc channel, e.g., omit /usb options in xfreerdp) and restrict client connections to trusted, known RDP servers only. Administrators should also inventory downstream products that bundle FreeRDP (Linux distro packages, Remmina and similar clients, embedded appliance firmware) and apply vendor patches when released.