CVE-2026-91961 in FreeRDP
Summary
by MITRE • 09/15/2026
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The vulnerability identified in FreeRDP versions prior to 3.31.0 represents a critical denial-of-service flaw located within the Universal Serial Bus Device Redirection Control (URBDRC) subsystem. This component is responsible for redirecting USB devices from a remote server to the local client machine, allowing users to interact with peripheral hardware over an RDP session. The specific defect resides in the handling of control-transfer requests, which are fundamental operations used to send commands and receive status information from connected USB devices. In this context, the software fails to perform adequate validation on the OutputBufferSize field contained within these request structures before passing them downstream to the libusb backend library. This lack of input sanitization creates a direct path for exploitation by an attacker controlling or manipulating the RDP server endpoint.
From a technical perspective, the core issue is a missing bounds check that allows a malicious actor to supply an excessively large value for OutputBufferSize. Specifically, sending a control-transfer request with this field set to 65536 bytes triggers a reachable assertion failure within the FreeRDP client process. An assertion error typically indicates that a program has encountered a condition it deems impossible or erroneous during normal operation, causing the software to abort execution immediately rather than handling the error gracefully. In this scenario, the oversized buffer size likely exceeds internal limits or expectations defined by the libusb integration layer, leading to an immediate termination of the client application. This behavior effectively results in a complete loss of availability for the user connected via RDP, as the graphical interface and session management processes are abruptly killed without warning or opportunity for recovery.
The operational impact of this vulnerability is significant for organizations relying on FreeRDP for remote desktop infrastructure. Since the attack vector requires only that an attacker controls the RDP server side of the connection, it poses a substantial risk in environments where users connect to untrusted or compromised servers, such as public cloud instances or shared hosting platforms. The resulting denial-of-service disrupts productivity and can lead to data loss if unsaved work is present on the client machine at the time of termination. Furthermore, because this vulnerability affects the core redirection mechanism for USB devices, it undermines the reliability of remote access solutions that depend heavily on peripheral functionality, such as smart card authentication or specialized hardware dongles.
This flaw aligns with CWE-20 Improper Input Validation and CWE-754 Unusual Control Sequence, reflecting a failure to adequately verify data integrity before processing. In terms of offensive security frameworks, this vulnerability is categorized under MITRE ATT&CK technique T1499 Endpoint Denial of Service, specifically within the sub-category of Resource Hijacking or Application Crash scenarios where an attacker leverages software bugs to disrupt service availability rather than gaining unauthorized access. The exploitation does not require privilege escalation on the client side but relies entirely on network-level interaction with a malicious server component.
Mitigation strategies primarily involve upgrading FreeRDP to version 3.31.0 or later, where this validation logic has been corrected to properly check and constrain buffer sizes before forwarding them to backend libraries. For environments unable to upgrade immediately due to dependency constraints, implementing strict network segmentation between client machines and untrusted RDP servers can reduce exposure. Additionally, deploying intrusion detection systems that monitor for anomalous USB redirection traffic patterns may provide early warning indicators of attempted exploitation attempts. Organizations should also ensure that their remote access policies restrict connections to verified and trusted server endpoints to minimize the risk surface associated with this type of input validation failure.