Description
FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denial of service when verbose asserts are enabled.
Published: 2026-09-15
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Out-of-Bounds Write
Action: Patch Immediately
AI Analysis

Impact

FreeRDP versions prior to 3.31.0 contain an out-of-bounds write in the urbdrc client channel’s urb_send_current_frame_number_result() function. A malicious Remote Desktop Protocol server can craft a 28-byte USB redirection message that forces the client to write 4 bytes beyond a 16-byte buffer, causing the client to crash when verbose assertions are enabled. The result is a denial of service against the user of the FreeRDP client. The flaw is a classic instance of memory corruption (CWE-617 and CWE-787).

Affected Systems

The affected software is FreeRDP, distributed under the name FreeRDP. All releases from version 3.14.0 up to and including 3.30.0 are vulnerable. Users running any of those releases remain exposed until they upgrade to 3.31.0 or later.

Risk and Exploitability

The base CVSS score of 7.1 indicates high severity, while the EPSS score of less than 1 % reflects a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. To exploit the flaw an attacker must control or compromise an RDP server and send a specially crafted USB redirection packet to a vulnerable client over the network. The observable effect is a crash of the FreeRDP client when verbose assertions are on, resulting in a temporary service interruption.

Generated by OpenCVE AI on September 20, 2026 at 16:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade FreeRDP to version 3.31.0 or newer
  • Disable the urbdrc channel or USB redirection in the client configuration if an immediate upgrade is not possible
  • Turn off verbose assertions in the FreeRDP build or execution environment to prevent the overflow from leading to a crash
  • Monitor client logs for unexpected USB redirection activity and employ network filtering to block malformed packets

Generated by OpenCVE AI on September 20, 2026 at 16:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 20 Sep 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 16 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 15 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denial of service when verbose asserts are enabled.
Title FreeRDP 3.14.0 through 3.30.0 Out-of-bounds Write via urbdrc
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-617
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-20T00:35:29.652Z

Reserved: 2026-09-15T11:07:34.398Z

Link: CVE-2026-91951

cve-icon Vulnrichment

Updated: 2026-09-20T00:30:28.458Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-15T16:17:49.340

Modified: 2026-09-24T12:15:20.537

Link: CVE-2026-91951

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-15T15:18:08Z

Links: CVE-2026-91951 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-20T16:30:18Z

Weaknesses