CVE-2026-91963

FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc

State: Published
Severity: 7.1 High
Published: Sep 15, 2026
Updated: Sep 15, 2026
Reserved: Sep 15, 2026

Description

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.

Scores

CVSS	Score	Vector	Source
4.0	7.1 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N	VulnCheck
3.1	6.5 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-457 Use of Uninitialized Variable

Affected Products

Product	Versions
FreeRDPFreeRDP	2.0.0 to before 3.0.0Affected 3.0.0 to before 3.31.0Affected 3.31.0Not affected
FreeRDPFreeRDP	before 3.31.0Affected 3.31.0Not affected

References

GitHub Security Advisory (GHSA-hw7p-5h2r-83gq)vendor-advisory
VulnCheck Advisory: FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrcthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.