CVE-2026-91951

Executive Summary

CVE-2026-91951 is an out-of-bounds write vulnerability in FreeRDP versions before 3.31.0, specifically within the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past an allocated 16-byte buffer. This flaw primarily results in a denial of service (DoS) when verbose assertions are enabled, with a CVSS score of 6.5. Organizations using FreeRDP as an RDP client, particularly in environments where USB redirection is enabled, are affected.

Technical Analysis

The vulnerability resides in the urbdrc client channel of FreeRDP, which handles USB device redirection over RDP. The function urb_send_current_frame_number_result() is responsible for processing a specific USB redirection message. According to the NVD description, a malicious RDP server can send a crafted 28-byte message. This message triggers an out-of-bounds write of 4 bytes beyond an allocated 16-byte buffer. The root cause is a buffer overflow due to insufficient bounds checking on the incoming message size relative to the destination buffer. The CWE classification is CWE-617 (Reachable Assertion), indicating that the out-of-bounds write leads to an assertion failure (denial of service) when verbose asserts are enabled. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) indicates that the attack is network-based, requires low complexity, no privileges, and user interaction (e.g., connecting to a malicious RDP server). There is no impact on confidentiality or integrity, but high impact on availability. The vulnerability class is a classic out-of-bounds write caused by a mismatch between expected and actual message sizes. The affected component is the urbdrc channel, which is used for USB redirection. The specific function name urb_send_current_frame_number_result() is given verbatim in the NVD description, and the buffer sizes (16-byte allocation, 4-byte overflow, 28-byte message) are explicitly stated. No further code-level details are available from the provided intelligence.

Exploitation Scenarios

No public PoC or exploit code is available; the attack chain is inferred from the vulnerability class and NVD description.

1. Reconnaissance/Target Identification: An attacker identifies a target that uses FreeRDP as an RDP client and has USB redirection enabled. This could be an enterprise workstation or server connecting to remote RDP servers. The attacker may control or compromise an RDP server that the victim connects to.

2. Triggering the Flaw: The attacker, acting as a malicious RDP server, sends a crafted 28-byte USB redirection message to the victim client. This message is processed by the urbdrc channel, specifically invoking urb_send_current_frame_number_result(). The message size (28 bytes) is designed to cause the function to write 4 bytes beyond the 16-byte buffer allocated for the result.

3. Payload/Execution Method: The out-of-bounds write occurs during the processing of the USB redirection message. The write is only 4 bytes past the buffer, which may corrupt adjacent memory. However, because the vulnerability is classified as CWE-617 (Reachable Assertion), the primary effect is that the corruption triggers an assertion failure when verbose asserts are enabled. In a production build without asserts, the corruption might be silent or lead to undefined behavior, but the described impact is denial of service.

4. Post-Exploitation Impact: Successful exploitation results in a crash of the FreeRDP client process, causing a denial of service. Depending on the environment, this could disrupt remote desktop sessions, potentially affecting user productivity or critical operations. There is no evidence of code execution, data exfiltration, or lateral movement from this vulnerability. The attacker cannot gain privileges or access sensitive information directly.

Impact Assessment

The CVSS score is 6.5 (Medium), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H. This indicates a network-based attack requiring no privileges but some user interaction (the victim must connect to the malicious server). The impact is solely on availability: a successful exploit crashes the client, causing a denial of service. Confidentiality and integrity are unaffected. The blast radius is limited to the individual client instance; however, in environments where FreeRDP is used for critical remote access (e.g., industrial control systems, remote administration), a DoS could have operational impacts. The EPSS score is 0.00346 (28th percentile), suggesting a low likelihood of exploitation in the wild at this time. No CISA KEV listing and no known threat actor campaigns. The patch confidence is 3/4 (LIKELY), with two independent sources (OSV and Debian) confirming the fix.

Detection Guidance

Sigma Rule

title: FreeRDP urbdrc Out-of-Bounds Write Attempt
id: 9a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential exploitation of CVE-2026-91951 via crafted USB redirection messages in FreeRDP
author: ValtersIT Threat Intelligence
date: 2026-01-01
logsource:
  product: windows
  service: application
  category: process_creation
detection:
  selection:
    Image|endswith: '\freerdp.exe'
    CommandLine|contains: '/usb'
  condition: selection
  falsepositives:
    - Legitimate use of USB redirection with FreeRDP
level: high
tags:
  - attack.t1190
  - cve.2026.91951

YARA Rule

rule CVE_2026_91951_FreeRDP_Urbdrc_OOB_Write
{
    meta:
        description = "Detects exploitation attempts for CVE-2026-91951 in FreeRDP urbdrc channel"
        author = "ValtersIT Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91951"
        hash = "unknown"
    strings:
        $s1 = "urb_send_current_frame_number_result" ascii wide nocase
        $s2 = "urbdrc" ascii wide nocase
    condition:
        any of them
}

Suricata IDS Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2026-91951 FreeRDP urbdrc Out-of-Bounds Write Attempt"; flow:to_client,established; content:"|00 00 00 1C|"; depth:4; content:"|00 00 00 00|"; within:4; distance:4; content:"|00 00 00 10|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within:4; content:"|00 00 00 00|"; distance:4; within