CVE-2026-91956

Executive Summary

CVE-2026-91956 is an out-of-bounds read vulnerability (CWE-125) in the FreeRDP client's URBDRC channel, specifically within func_get_ep_desc. The function indexes interface arrays by position rather than by the protocol-supplied InterfaceNumber field, so a malicious RDP server can send a crafted SELECT_CONFIGURATION message with permuted InterfaceNumber values and cause the client to read past allocated heap memory. Successful exploitation crashes the FreeRDP client, producing a denial-of-service condition on the connecting endpoint; the CVSS v3.1 score is 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H).

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP) used both as a client and as a library (e.g., in remote desktop gateways, thin-client appliances, and third-party RDP-aware products). This vulnerability resides in the URBDRC channel — the protocol channel that implements USB device redirection over RDP (RemoteFX USB redirection). URBDRC carries USB descriptor data and enables a local USB device to be redirected to the remote session.

The flaw is classified as CWE-125 (Out-of-bounds Read) and is localized to the func_get_ep_desc function. Per the NVD description, this function retrieves endpoint descriptor information from an interface array and indexes that array by position (sequential offset) rather than by the descriptor's protocol field InterfaceNumber. USB descriptors carry an InterfaceNumber that identifies which interface an endpoint belongs to; endpoint descriptors within a configuration must be associated with the correct parent interface using that number. When a server instead supplies a SELECT_CONFIGURATION message with permuted InterfaceNumber values (i.e., numbers that do not match the positional ordering of the interface array), the client dereferences or reads an array slot outside the bounds of the allocated heap buffer.

Because the out-of-bounds access is a read rather than a write, the practically observable outcome is a memory-safety fault leading to a client crash (segmentation fault / access violation) rather than remote code execution. The CVSS subscores are consistent with this: Confidentiality: None, Integrity: None, Availability: High. The attack is network-reachable (AV:N) with low complexity (AC:L) and no privileges (PR:N), but requires user interaction (UI:R) — the victim must actively connect the FreeRDP client to the attacker-controlled server. The scope is Unchanged (S:U), meaning impact is confined to the vulnerable client component.

Attack surface: any FreeRDP-based RDP client that enlists the URBDRC/USB-redirection channel during session negotiation. The malicious actor is the server side of the RDP connection — an unusual inversion of trust, since RDP clients frequently connect to servers operated by third parties (cloud desktops, hosting providers, VDI brokers). The URBDRC channel receives the SELECT_CONFIGURATION message during USB redirection setup, prior to any actual USB device data exchange, so the trigger occurs early in the redirection handshake.

Root cause class: improper validation of protocol-declared indices against array bounds. Correct handling requires mapping InterfaceNumber to the allocated interface array via a bounds-checked lookup, rejecting or clamping values that fall outside [0, num_interfaces), rather than trusting a positional assumption.

No public proof-of-concept, exploit code, or Nuclei template was identified at the time of writing. No CISA KEV listing exists, and EPSS is 0.00346 (28.0th percentile), indicating a low near-term probability of exploitation in the wild.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1) Reconnaissance / target identification. The attacker establishes or controls an RDP server (or compromises one) reachable by the victim, and configures it to negotiate the URBDRC USB-redirection channel. The attacker identifies victims as users/clients running FreeRDP versions prior to 3.31.0 who will connect to that server and permit (or auto-accept) USB redirection.

2) Triggering the specific flaw. On client connection, the malicious server sends a crafted SELECT_CONFIGURATION message in which the InterfaceNumber values of the interface descriptors are permuted — that is, set to values that do not correspond to their positional index in the interface array. When the client processes the configuration, func_get_ep_desc selects an interface array element by position instead of resolving the element via the supplied InterfaceNumber. The permuted mapping drives the function past the end of the allocated heap buffer, producing an out-of-bounds read.

3) Payload / execution method. The "payload" is the descriptor structure embedded in the SELECT_CONFIGURATION message itself. No shellcode or memory-corruption primitive is required to achieve the described impact; the malformed descriptor alone is sufficient to force the OOB read. There is no evidence in the provided data of a write primitive, so exploitation is limited to the read/crash outcome.

4) Post-exploitation impact. The consequence is availability loss on the client: the out-of-bounds read triggers a memory access fault that crashes the FreeRDP client. An attacker could repeatedly induce crashes against a victim population by hosting the malicious server, disrupting user remote-desktop sessions. No confidentiality or integrity impact is described, and the read is not reported to be weaponizable for code execution from the available data.

Impact Assessment

• Confidentiality (C:N): The out-of-bounds read is not described as leaking data to the attacker; no confidentiality impact.
• Integrity (I:N): No memory write or data tampering is described; no integrity impact.
• Availability (A:H): The client crash constitutes a high availability impact — the user's session terminates abruptly and can be repeated.
• Blast radius: Each affected connection impacts a single client session on the connecting endpoint. Because the attack originates from the server, any FreeRDP-based client connecting to an attacker-controlled or compromised RDP server is potentially affected. Automated or high-volume environments (VDI thin clients, kiosks, gateways embedding FreeRDP) could see repeated session losses if a malicious server is used broadly.
• Business impact: Predominantly denial-of-service and productivity disruption; potential for repeated client crashes to be leveraged in social-engineering or nuisance campaigns. Low EPSS (0.00346) and absence from CISA KEV suggest limited current exploitation activity.

Detection Guidance

Sigma Rule

title: FreeRDP URBDRC Out-of-Bounds Read Attempt (CVE-2026-91956)
id: 3f9c2b41-7a8e-4c1d-9f3a-919561000001
status: experimental
description: Detects FreeRDP client crashes correlated with URBDRC USB redirection negotiation, potentially indicating CVE-2026-91956 exploitation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91956
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: audit
detection:
  selection_process:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/sdl-freerdp'
  selection_crash:
    Keywords|contains:
      - 'SIGSEGV'
      - 'segfault'
      - 'func_get_ep_desc'
  condition: selection_process and selection_crash
falsepositives:
  - Legitimate FreeRDP crashes unrelated to URBDRC
  - Debugging sessions
level: medium
tags:
  - attack.t1204
  - cve.2026.91956

YARA Rule

rule CVE_2026_91956_FreeRDP_URBDRC_OOB_Read
{
    meta:
        description = "Detects references to the vulnerable FreeRDP URBDRC func_get_ep_desc routine and SELECT_CONFIGURATION handling"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91956"
        date = "2026-01-01"
        cve = "CVE-2026-91956"
    strings:
        $s1 = "func_get_ep_desc" ascii wide
        $s2 = "SELECT_CONFIGURATION" ascii wide
        $s3 = "InterfaceNumber" ascii wide
        $s4 = "URBDRC" ascii
    condition:
        uint16(0) == 0x5a4d and 2 of ($s*)
}

Suricata IDS Rule

alert tcp any 3389 -> any any (msg:"CVE-2026-91956 FreeRDP URBDRC SELECT_CONFIGURATION OOB Read Attempt"; flow:from_server,established; content:"|0a 01|"; content:"|03 01|"; pcre:"/SELECT_CONFIGURATION|InterfaceNumber/i"; metadata:cve CVE-2026-91956, affected_product FreeRDP, attack_target Client_Endpoint, deployment Perimeter, signature_severity Minor; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-91956; classtype:attempted-dos; sid:9195601; rev:1;)

Elastic Detection

process where process.name in ("xfreerdp","wlfreerdp","sdl-freerdp") and
  process.command_line != null and
  (process.exit_code == 139 or process.exit_code == 11) and
  event.action == "end"

Splunk SPL Query

index=endpoint sourcetype=syslog OR sourcetype=linux_audit ("xfreerdp" OR "wlfreerdp" OR "sdl-freerdp")
| search ("segfault" OR "SIGSEGV" OR "func_get_ep_desc" OR "URBDRC")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process, user
| where count > 1
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91956,">
  <rule id="919561" level="7">
    <decoded_as>syslog</decoded_as>
    <match>xfreerdp|wlfreerdp|sdl-freerdp</match>
    <description>CVE-2026-91956: FreeRDP client crash during URBDRC negotiation (possible OOB read)</description>
    <regex>segfault|SIGSEGV|func_get_ep_desc|URBDRC</regex>
    <mitre>
      <id>T1204</id>
    </mitre>
    <group>cve_2026_91956,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source (OSV) claims the fix; not independently confirmed by the vendor channel in the provided data). Treat the 3.31.0 threshold as provisional and verify against the official FreeRDP release notes before relying on it.

1. Immediate mitigations:

   • If USB redirection is not required, disable the URBDRC/drive-redirection channel in client configurations (do not invoke the /usb or equivalent URBDRC-based redirection option).
   • Restrict connectivity to RDP servers that are known and trusted; treat connecting to arbitrary or third-party RDP servers as higher risk.
   • Where feasible, gate FreeRDP clients behind application allow-listing / egress controls so users cannot connect to untrusted RDP endpoints.
   • Deploy the Sigma/EDR rules above to surface repeated client crashes indicative of attempted exploitation.

2. Patch / upgrade steps:

   • Upgrade FreeRDP to 3.31.0 or later, as claimed by OSV. Verify the fix exists in the official FreeRDP repository tags/release notes before deployment.
   • Rebuild or update any third-party products embedding FreeRDP as a library, and confirm their bundled FreeRDP version.
   • Stage the upgrade in a test environment and validate that USB redirection functionality is unaffected.

3. Long-term hardening:

   • Track FreeRDP security advisories and subscribe to release notifications; run FreeRDP clients in a memory-safety-hardened environment (compiler sanitizers in test, guard pages, hardened allocators).
   • Apply network segmentation so client endpoints do not freely reach untrusted RDP servers.
   • Monitor for the upstream class of bug (positional array indexing vs. protocol-declared indices) and fuzz the URBDRC channel as part of ongoing assurance.

References

• NVD — CVE-2026-91956: https://nvd.nist.gov/vuln/detail/CVE-2026-91956
• OSV advisory entry (patch claim source for 3.31.0)
• FreeRDP project releases: https://github.com/FreeRDP/FreeRDP/releases
• CWE-125 Out-of-bounds Read: https://cwe.mitre.org/data/definitions/125.html
• MITRE ATT&CK T1204 (User Execution): https://attack.mitre.org/techniques/T1204/

Threat actor / in-the-wild note: No CISA KEV listing, no public PoC, no Nuclei template, and no documented threat actor campaign were identified for CVE-2026-91956 in the provided intelligence. EPSS of 0.00346 (28.0th percentile) indicates a low estimated likelihood of exploitation in the wild at time of writing.