CVE-2026-91961

Executive Summary

CVE-2026-91961 is a denial-of-service vulnerability in FreeRDP versions before 3.31.0, located in the URBDRC (USB Redirection Channel) control-transfer request path. A malicious or compromised RDP server can send a crafted control-transfer request specifying OutputBufferSize of 65536, which is forwarded to the libusb backend without validation, triggering a reachable assertion that terminates the client process. Exploitation requires the victim to initiate an RDP connection to a hostile server (user interaction), yielding availability impact only — no confidentiality or integrity loss. The CVSS base score is 6.5 (Medium).

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol (RDP), widely deployed as a client on Linux, macOS, and other platforms, and embedded in thin-client, VDI, and remote-access products. The URBDRC channel implements USB device redirection over RDP, allowing a remote server to present USB devices to the connecting client. That channel includes a control-transfer request path, where control-transfer requests (a standard USB transfer type) are relayed from the RDP server side to the client's local libusb backend for execution against locally attached USB devices.

The vulnerability mechanism described is an unchecked input validation failure leading to a reachable assertion (CWE-617). Specifically, the URBDRC control-transfer request handling path fails to validate the OutputBufferSize field before forwarding the request into the libusb backend. When a malicious RDP server sets OutputBufferSize to 65536, the value passes unvalidated into the backend, where a reachable assertion fails and the client process is terminated (abort). Because the assertion is reachable through a normal channel message, this is not merely a theoretical overflow — the server can deterministically cause a client crash.

Two technical characteristics are noteworthy:

1. Server-driven trigger. In RDP USB redirection, the server instructs the client to perform USB transfers on the server's behalf. This inverts the typical trust assumption: the connecting client implicitly trusts channel data from the server. A malicious server therefore controls the OutputBufferSize field directly.
2. Assertion vs. memory corruption. The CNA/NVD description specifies an assertion-triggered termination, not a buffer overflow or memory-corruption primitive. As described, the primary impact is process termination (availability). No information disclosure or code execution is claimed by the description, and no public evidence of such primitives exists.

The exact assertion location, source file, and function names are not disclosed in the NVD description and therefore cannot be stated without fabrication. No further code-level detail is available.

Exploitation Scenarios

Attack class: malicious-server-driven client denial of service via unvalidated channel field.

No public PoC, exploit code, or Nuclei template is available (PoC Status: None). The attack chain below is inferred strictly from the vulnerability class and the NVD description; no implementation-specific names beyond OutputBufferSize and the URBDRC control-transfer path are known.

1. Reconnaissance / target identification. An attacker identifies a victim who will connect a FreeRDP-based client (version < 3.31.0) to an attacker-controlled RDP endpoint. This may be achieved by operating a rogue RDP server, a man-in-the-middle position, DNS/redirect hijacking, or a compromised legitimate RDP server. The attacker needs the victim to connect to the attacker's server, not the reverse.

2. Triggering the flaw. Once the victim's client establishes the RDP session and negotiates the URBDRC (USB redirection) virtual channel, the malicious server sends a control-transfer request with the OutputBufferSize field set to 65536. The client's URBDRC control-transfer path forwards this value to the libusb backend without validating it against the expected bounds, and a reachable assertion fires.

3. Payload / execution method (vulnerability-class level). No memory-corruption payload or shellcode is involved per the description. The "payload" is the crafted channel message containing the oversized OutputBufferSize value on the URBDRC control-transfer request. Delivering this single malformed message is sufficient to reach the failing assertion.

4. Post-exploitation impact. The FreeRDP client process terminates abnormally (assertion-triggered abort). Consequences are availability-only: the user loses their remote session; if the client manages other sessions, those may be affected; recurring crashes can be triggered by reconnecting. No theft of credentials, no code execution, and no lateral movement are supported by the described mechanism.

Prerequisites: (a) victim runs an affected FreeRDP client, (b) victim initiates a connection to the malicious server, (c) the URBDRC/USB-redirection channel is enabled (or the attacker prompts/enables it). User interaction (initiating the connection) is required, consistent with the CVSS UI:R rating.

Impact Assessment

• Confidentiality (C:N): None — the described flaw does not expose data.
• Integrity (I:N): None — no data modification is described.
• Availability (A:H): High — the client process is deterministically terminated.
• Attack Vector (AV:N): Network — the trigger arrives over the RDP session; the attacker is remote.
• Attack Complexity (AC:L): Low — a single malformed channel message with a fixed value triggers the assertion.
• Privileges Required (PR:N): None — the attacker needs no credentials on the victim client, only that the victim connects.
• User Interaction (UI:R): Required — the victim must initiate/accept the RDP connection.
• Scope (S:U): Unchanged — the impact is confined to the client process.

Business impact. Organizations running FreeRDP-based clients (thin clients, VDI endpoints, Linux/macOS remote-access desktops, embedded RDP clients) face session-disruption risk. Because the trigger is server-side, any deployment where users connect to untrusted, third-party, or attacker-controllable RDP servers is exposed. Repeated exploitation could cause sustained denial of service against individual users, degrading remote-work availability. Exploitation is not trivially opportunistic (it requires a malicious server and willing victim connection), and the EPSS score of 0.00346 (28.0th percentile) indicates low predicted exploitation activity. No CISA KEV listing exists. Blast radius is bounded to the client process; servers, back-ends, and network infrastructure are not directly impacted.

Detection Guidance

Detection is inherently difficult because the malicious traffic rides inside an RDP session on TCP/3389 and after TLS negotiation, and the trigger is a single channel message. Correlation of client-side process aborts with RDP sessions and URBDRC channel activity is the primary detection strategy.

Sigma Rule

title: FreeRDP Client Crash via URBDRC Control-Transfer (CVE-2026-91961)
id: 7b2c9e4a-9196-161c-ab04-000000000001
status: experimental
description: Detects abnormal termination of FreeRDP client processes that may indicate exploitation of CVE-2026-91961 in the URBDRC control-transfer path.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91961
author: valtersit.com
date: 2026/01/01
tags:
  - attack.t1499
  - attack.impact
logsource:
  category: process_creation
  product: linux
detection:
  selection_proc:
    Image|endswith:
      - '/xfreerdp'
      - '/wlfreerdp'
      - '/sdl-freerdp'
  selection_fault:
    CommandLine|contains:
      - 'Assertion'
      - 'URBDRC'
      - 'urbdrc'
  condition: selection_proc and selection_fault
falsepositives:
  - Legitimate client crashes due to unrelated bugs
level: medium

YARA Rule

rule CVE_2026_91961_FreeRDP_URBDRC_Fingerprint
{
    meta:
        author = "valtersit.com"
        description = "Detects FreeRDP URBDRC control-transfer handling that references OutputBufferSize; correlate with affected versions < 3.31.0"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91961"
        date = "2026-01-01"
        cve = "CVE-2026-91961"

    strings:
        $urbdrc   = "URBDRC" ascii wide nocase
        $ctrltx   = "control-transfer" ascii wide nocase
        $obsize   = "OutputBufferSize" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and $urbdrc and ($ctrltx or $obsize)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 3389 ( \
  msg:"CVE-2026-91961 FreeRDP URBDRC control-transfer to external RDP server (potential malicious server)"; \
  flow:established,to_server; \
  dsize:>0; \
  threshold:type both, track by_src, count 20, seconds 60; \
  sid:202691961; rev:1; \
  reference:cve,2026-91961; \
  classtype:attempted-dos; \
  metadata:service rdp; )

Note: Because RDP channel payloads are encrypted after negotiation, this rule flags connection setup to external RDP servers as a contextual signal rather than inspecting the cleartext trigger. Deploy it as a discovery/context rule, not a signature for the payload itself.

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name in ("xfreerdp","wlfreerdp","sdl-freerdp") and event.action == "start"]
  [process where event.action in ("end","exit") and process.exit_code == 134]

This EQL sequence correlates a FreeRDP client start with an abort (SIGABRT, exit code 134) shortly afterward, the expected signature of a failure assertion firing during an RDP session.

Splunk SPL Query

index=endpoint (process_name="xfreerdp" OR process_name="wlfreerdp" OR process_name="sdl-freerdp")
| transaction process_id maxspan=60s
| search (event_type="process_start" OR action="process_start") AND (exit_code="134" OR signature="SIGABRT" OR signature="Aborted")
| stats count min(_time) as first_seen max(_time) as last_seen by host, process_name, process_id
| where count >= 1
| table host, process_name, process_id, first_seen, last_seen
| sort - last_seen

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91961,">
  <rule id="100961" level="8">
    <decoded_as>ossec</decoded_as>
    <match>URBDRC|urbdrc</match>
    <description>FreeRDP URBDRC channel error - possible CVE-2026-91961 control-transfer abuse</description>
  </rule>

  <rule id="100962" level="10">
    <if_sid>100961</if_sid>
    <match>Assertion|assertion failed|Aborted</match>
    <description>FreeRDP client aborted during URBDRC handling - suspected CVE-2026-91961 denial-of-service</description>
    <mitre>
      <id>T1499</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — a single source (OSV) claims a fix, not independently confirmed). No CISA KEV listing. No public workaround published by the vendor.

1. Immediate mitigations (no verified vendor workaround exists):

   • Disable USB redirection / the URBDRC channel where it is not operationally required. This removes the attack surface entirely, as the flaw resides in the USB redirection channel; if the channel is not negotiated, the malicious server cannot deliver the control-transfer request.
   • Restrict client connections to trusted RDP servers via allow-listing, firewall egress rules, and policy. Since exploitation requires the victim to connect to a malicious server, controlling which servers clients may reach directly blunts the attack.
   • Monitor and alert on repeated client aborts (exit code 134 / SIGABRT) correlated with RDP sessions, per the detection rules above.

2. Patch / upgrade steps (per the OSV claim, unconfirmed):

   • Upgrade FreeRDP to 3.31.0 or later. Note: the affected-version list and OSV package data are currently empty/unfixed in the provided intelligence, so teams should verify the fixed version directly against the upstream FreeRDP release notes and confirm the URBDRC validation change before relying on the upgrade.
   • Because patch confidence is only 2/4, treat 3.31.0 as claimed fixed and validate via change tracking or vendor confirmation. Rebuild/pull updated packages from your distribution or from the upstream project, and inventory embedded FreeRDP deployments (thin clients, VDI images, vendor products) that may bundle older versions.

3. Long-term hardening:

   • Enforce a hardened RDP client posture: disable unused virtual channels (USB redirection, drive redirection, etc.) by policy.
   • Adopt a software bill of materials (SBOM) and dependency tracking to detect embedded FreeRDP versions in third-party and OEM products.
   • Keep clients current through automated patch management; prioritize client libraries that parse remote (server-controlled) data.
   • Treat any RDP endpoint as untrusted for channel data — defense-in-depth assumptions should not rely on server goodwill.

References

1. NVD — CVE-2026-91961: https://nvd.nist.gov/vuln/detail/CVE-2026-91961
2. OSV — CVE-2026-91961 (single-source patch claim): https://osv.dev/vulnerability/CVE-2026-91961
3. FreeRDP Project — upstream repository and release notes: https://github.com/FreeRDP/FreeRDP
4. MITRE ATT&CK — T1499 Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
5. CWE-617 — Reachable Assertion: https://cwe.mitre.org/data/definitions/617.html

Exploit-in-the-wild / threat actor evidence: None. No public PoC, exploit code, or Nuclei template exists for CVE-2026-91961; the CVE is not listed in CISA KEV; and the EPSS score (0.00346) indicates low predicted exploitation probability. No named threat-actor campaign is associated with this vulnerability in the available intelligence.