CVE-2026-91963

Executive Summary

CVE-2026-91963 is an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel of FreeRDP versions prior to 3.31.0. A malicious RDP server can induce failing USB transfers to force the FreeRDP client to return uninitialized heap contents, leaking memory that defeats ASLR and provides a primitive that can be chained with a separate memory corruption vulnerability to achieve remote code execution. Any endpoint or user running an affected FreeRDP-based client that connects to an attacker-controlled RDP server is at risk; exploitation requires user interaction (the victim must initiate the RDP session), but no privileges are required and confidentiality impact is rated High.

Technical Analysis

FreeRDP is an open-source implementation of the Remote Desktop Protocol used by a wide range of clients, libraries, and embedded products. The vulnerability resides in the urbdrc channel, FreeRDP's implementation of the USB device redirection virtual channel (URBDRC) specified by Microsoft for RDP. This channel allows a client to redirect locally attached USB devices to a remote RDP server, and is therefore bidirectional in trust: while the server normally drives the session, the channel logic on the client processes server-originated request/response messages that govern USB transfers.

The flaw is classified as CWE-457, Use of Uninitialized Variable. According to the NVD description, the vulnerable behavior is triggered when USB transfers fail. Under that condition, the urbdrc channel processes a failing transfer in a way that causes uninitialized heap memory to be read and subsequently disclosed. Because the memory is heap-allocated and never initialized before being read, its contents reflect whatever data previously occupied that allocation — potentially pointer values, session-related addresses, or other sensitive bytes from the client process address space.

The root-cause class here is an output/information leak caused by missing initialization and inadequate validation of transfer state on the failure path. Conceptually, the client allocates a buffer to service a USB transfer, the server causes the transfer to fail (or supplies a response that drives the transfer into a failure state), and the code path taken on failure returns or transmits the buffer without having populated it with fully initialized data. The result is a client-to-server information disclosure: data flows from the client back toward the malicious RDP server.

This is significant because heap memory disclosures are a classic ASLR-bypass primitive. Address space layout randomization is a hardening measure; leaked heap pointers reveal the runtime location of heap allocations and, by extension, useful anchors for defeating randomization in chained exploits. The NVD description explicitly frames the impact as "defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities." CVE-2026-91963 is therefore best understood as a reconnaissance/primitive-delivery bug rather than a standalone RCE: on its own it leaks memory but does not by itself corrupt control flow.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (base 6.5) is consistent with this analysis:

• Attack Vector: Network — the malicious party is an RDP server reachable over the network.
• Attack Complexity: Low — no special conditions beyond inducing a failing USB transfer.
• Privileges Required: None — the attacker operates as an RDP server, not an authenticated client.
• User Interaction: Required — the victim must connect their FreeRDP client to the malicious server.
• Scope: Unchanged — the impact is confined to the vulnerable client component.
• Confidentiality: High — heap memory contents are disclosed.
• Integrity and Availability: None — the bug alone does not modify or disrupt data. Note that the CVSS base score does not capture the downstream RCE risk when chained with a memory corruption vulnerability; the true severity of the bug in a chained exploit context is higher than 6.5.

The EPSS score is 0.00640 (49.0th percentile), and there is no evidence of exploitation in CISA KEV, no public PoC, no Nuclei template, and no public exploit code at the time of writing. Affected version data lists FreeRDP packages before 3.31.0 with unfixed indicators in the OSV-derived records, and the patch source is a single OSV claim (patch confidence 2/4). The urbdrc channel is not universally enabled in all client configurations — its reachability depends on whether the USB redirection channel is negotiated for the session, which is an important scoping factor.

Exploitation Scenarios

Because no public PoC or exploit code exists, the chain below is inferred from the vulnerability class (uninitialized heap memory disclosure in a USB redirection channel) and must be read at that level of abstraction. No function names, message types, or internal identifiers beyond "urbdrc" and "USB transfers" are provided in the source data, and none are invented here.

1. Reconnaissance / target identification. The attacker identifies FreeRDP client users — endpoints, thin clients, or embedded/OT environments that use FreeRDP-based RDP clients and permit USB redirection. Public binary version strings or vendor advisories can narrow the target set to versions before 3.31.0. The attacker must control or compromise an endpoint that speaks RDP and to which the victim will connect — for example a rogue RDP server, a compromised jump host, or a man-in-the-middle position on an RDP session where the server side is attacker-controlled.

2. Triggering the flaw (vulnerability class level). The victim initiates an RDP session to the malicious server and negotiates the urbdrc USB redirection channel. The malicious server then causes USB transfers associated with the redirection channel to fail. Driving the transfer into a failure state is the specific trigger: per the NVD description, it is failing USB transfers that induce the read of uninitialized heap memory. No specific malformed message structure is claimed here, because the source data does not describe one.

3. Payload / disclosure step (vulnerability class level). On the failing-transfer path, the client processes the transfer and returns data derived from an uninitialized heap allocation back toward the server. The disclosed bytes may include heap-resident pointers and other residual memory contents. This is the information-disclosure primitive: the attacker receives client-side heap memory over the RDP channel.

4. Post-exploitation impact. Two paths follow:

   • Standalone: the leaked heap memory is used to defeat ASLR by deriving the runtime base/offset of heap-allocated structures. This is an intelligence-gathering step that improves the reliability of subsequent attacks but does not by itself achieve code execution.
   • Chained: the ASLR defeat is combined with a separate memory corruption vulnerability in FreeRDP or a related component to achieve remote code execution on the client. The NVD description explicitly calls out this chaining path.

Because no PoC exists, defenders should not expect a ready-made exploit; however, the primitive is attractive precisely because it is a memory-safety enabler. The absence of KEV listing and a low EPSS score indicate no observed exploitation in the wild at time of writing, but that should not be interpreted as low risk for organizations that chain this with other unfixed memory-safety bugs.

Impact Assessment

The primary impact is confidentiality loss on the FreeRDP client. Per the CVSS vector, Confidentiality is High while Integrity and Availability are None — this CVE alone does not let an attacker alter the client's state or cause a denial of service. Exploitation requires User Interaction (the victim must connect to the malicious server) but no attacker privileges, and the attack vector is Network, meaning the malicious server can be remote.

Business impact is driven largely by where FreeRDP clients are deployed. FreeRDP is used in Linux/BSD/macOS desktop RDP clients, in thin-client and VDI environments, in embedded and industrial systems, and as a library in third-party products that embed RDP clients. In OT/ICS, healthcare, and financial environments, endpoints that connect to arbitrary or third-party RDP servers and allow USB redirection represent the highest-risk population: the attacker is the server operator, and USB redirection is the channel required.

Blast radius: any single user who can be induced to connect to an attacker-controlled RDP server can leak heap memory from their client process. In a chained exploit, that user's session and endpoint could be compromised, providing a foothold into the enterprise network from an endpoint that initiated an outbound RDP connection — a topology that frequently traverses perimeter controls. The vulnerability is not remotely exploitable without victim action, and it does not self-propagate.

Risk prioritization: base score 6.5 understates chained risk. Organizations that maintain other unpatched FreeRDP memory-safety issues should treat CVE-2026-91963 as a force multiplier and prioritize the upgrade to 3.31.0. Organizations that can disable or restrict USB redirection reduce exposure substantially regardless of patch state.

Detection Guidance

Sigma Rule

title: FreeRDP Client Connected to Suspicious RDP Server (urbdrc Channel)
id: 8e7c1a44-2d3b-4f61-9c8e-1a2b3c4d5e6f
status: experimental
description: Detects FreeRDP client processes establishing outbound RDP sessions, relevant to CVE-2026-91963 exploitation where a malicious RDP server tunnels data via the urbdrc channel.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-91963
author: valtersit.com
date: 2026-01-01
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - '\xfreerdp.exe'
        - '\wfreerdp.exe'
        - '\freerdp.exe'
  selection_cli:
    CommandLine|contains:
      - 'urbdrc'
      - '/usb'
      - '+usb'
  condition: selection_img and selection_cli
fields:
  - Image
  - CommandLine
  - User
  - ParentImage
falsepositives:
  - Legitimate users who intentionally enable USB redirection to trusted internal RDP servers
level: medium
tags:
  - attack.t1190
  - cve.2026.91963

YARA Rule

rule CVE_2026_91963_FreeRDP_urbdrc_Version
{
    meta:
        description = "Detects FreeRDP client binaries prior to 3.31.0 that contain urbdrc USB redirection support potentially affected by CVE-2026-91963"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-91963"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "urbdrc" ascii nocase
        $s2 = "URBDRC" ascii
        $s3 = "FreeRDP" ascii
        $s4 = "3.30" ascii
        $s5 = "3.29" ascii
        $s6 = "3.28" ascii

    condition:
        uint16(0) == 0x5A4D or uint32(0) == 0x464C457F
        and $s1
        and any of ($s4, $s5, $s6)
        and filesize < 50MB
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 3389 (msg:"CVE-2026-91963 FreeRDP Client Outbound RDP Session to External Server (urbdrc memory disclosure risk)"; flow:to_server,established; content:"|03 00|"; depth:2; byte_test:1,=,0,2; dsize:>6; threshold:type limit, track by_src, count 4, seconds 60; classtype:policy-violation; sid:202691963; rev:1; metadata:cve CVE-2026-91963, vendor FreeRDP;)

Elastic Detection

sequence by process.entity_id with maxspan=5m
  [process where process.name : ("xfreerdp", "wfreerdp", "freerdp", "xfreerdp.exe", "wfreerdp.exe") and
     process.command_line : "*urbdrc*"]
  [network where destination.port == 3389 and event.action == "connection_attempted" and
     network.direction == "egress"]

Splunk SPL Query

index=endpoint OR index=network
| search (Image="*freerdp*" OR process_name="*freerdp*" OR CommandLine="*urbdrc*")
| eval risk=if(match(CommandLine,"urbdrc|/usb|\+usb"),"high","low")
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ips values(CommandLine) as cmdline by host user risk
| where risk="high" AND (dest_port=3389 OR match(dest_ips,".*"))
| sort - count

Wazuh OSSEC Rule

<group name="freerdp,cve-2026-91963,">
  <rule id="100919630" level="6">
    <decoded_as>json</decoded_as>
    <field name="process.name">xfreerdp|wfreerdp|freerdp</field>
    <field name="command_line">urbdrc</field>
    <description>CVE-2026-91963: FreeRDP client launched with urbdrc USB redirection channel; verify destination server is trusted (versions before 3.31.0 vulnerable to heap memory disclosure).</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_91963,uninitialized_memory,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 — CLAIMED (single source claims patch, not independently confirmed).

1. Immediate mitigations

• Upgrade FreeRDP-based clients to version 3.31.0 or later. Do not rely solely on the single OSV patch claim — verify the release notes of 3.31.0 independently with the upstream project before treating a deployment as remediated.
• Disable or deny USB redirection (the urbdrc channel) in FreeRDP client configurations and in managed client policies. The vulnerability is only reachable when the USB redirection channel is negotiated, so removing it eliminates the trigger for the vulnerable code path.
• Restrict which RDP servers client endpoints may connect to. Because the attacker must act as the RDP server, allowlisting trusted RDP endpoints breaks the trust assumption the attack relies on.
• Educate users not to connect their RDP clients to untrusted or unsolicited RDP servers, and block unsolicited inbound RDP invitations.

2. Patch / upgrade steps

• Identify all FreeRDP client deployments and embedded FreeRDP libraries (desktop clients, thin clients, third-party products that bundle FreeRDP).
• Confirm affected version (before 3.31.0) via binary version strings and vendor inventories.
• Deploy the 3.31.0-or-later release through your standard software management pipeline; for embedded products, request vendor firmware updates.
• Re-scan post-upgrade to confirm the version string no longer matches the pre-3.31.0 pattern and that urbdrc behavior is updated.
• Since patch confidence is only 2/4, retain compensating controls (no USB redirection, server allowlists) until independent confirmation is available.

3. Long-term hardening

• Maintain a software bill of materials (SBOM) that includes FreeRDP and other networked protocol clients so future CVEs can be triaged by component rather than by discovery.
• Enforce least-functionality defaults: disable USB redirection and other high-risk virtual channels unless a documented business requirement exists.
• Deploy host-based memory exploitation mitigations (e.g., enabling existing OS exploit protection features) so that an ASLR-defeating leak is harder to convert into RCE when chained with another memory corruption flaw.
• Monitor for other unpatched memory-safety issues in FreeRDP and apply defense-in-depth, since CVE-2026-91963 acts as a primitive enabler for chained exploits.

References

• NVD — CVE-2026-91963: https://nvd.nist.gov/vuln/detail/CVE-2026-91963
• FreeRDP project (upstream; verify 3.31.0 release notes and advisory): https://www.freerdp.com/
• FreeRDP GitHub releases (patch verification for 3.31.0): https://github.com/FreeRDP/FreeRDP/releases
• OSV — FreeRDP vulnerability records (patch claim source; listed as unfixed in provided data): https://osv.dev/
• CWE-457 — Use of Uninitialized Variable: https://cwe.mitre.org/data/definitions/457.html

Note on threat actor activity: There is currently no evidence of exploitation in the wild for CVE-2026-91963. The CVE is not listed in CISA KEV, EPSS is 0.00640 (49.0th percentile), and no public PoC, exploit code, or Nuclei template is available. Any claim of active campaigns would be speculative and is therefore not asserted here.