Medium severity6.5NVD Advisory· Published Sep 15, 2026· Updated Sep 23, 2026

CVE-2026-91963

Description

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Freerdp/Freerdp2 versions
cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*range: >=2.0.0,<3.31.0
- (no CPE)range: <3.31.0
osv-coords6 versions
pkg:rpm/almalinux/freerdp pkg:rpm/almalinux/freerdp-devel pkg:rpm/almalinux/freerdp-libs pkg:rpm/almalinux/freerdp-server pkg:rpm/almalinux/libwinpr pkg:rpm/almalinux/libwinpr-devel
< 2:3.10.3-12.el10_2.14+ 5 more
- (no CPE)range: < 2:3.10.3-12.el10_2.14
- (no CPE)range: < 2:3.10.3-12.el10_2.14
- (no CPE)range: < 2:3.10.3-12.el10_2.14
- (no CPE)range: < 2:3.10.3-12.el10_2.14
- (no CPE)range: < 2:3.10.3-12.el10_2.14
- (no CPE)range: < 2:3.10.3-12.el10_2.14

Patches

Vulnerability mechanics

References

github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gqnvdVendor Advisory
www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrcnvdThird Party Advisory

News mentions

FreeRDP: 20 Vulnerabilities Disclosed, Including Critical RDSTLS Bypass
Vypr Intelligence · Sep 15, 2026

cvss	0.423
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000