CVE-2026-91963: 
Wolfi vulnerability analysis and mitigation

CVE-2026-91963 is an uninitialized heap memory disclosure vulnerability in FreeRDP's urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to cause the client to transmit uninitialized heap memory back to the server, defeating ASLR and enabling remote code execution when chained with a memory corruption vulnerability. It affects FreeRDP versions 2.0.0 through 3.30.0 (all 2.x and 3.x releases before 3.31.0), as well as Remmina 1.4.x when using the system libfreerdp with USB redirection enabled. The vulnerability was disclosed on September 1, 2026 via a FreeRDP security advisory and published to NVD on September 15, 2026. It carries a CVSS v3.1 score of 6.5 (High) and a CVSS v4.0 score of 7.1 (High) (FreeRDP Advisory, GitHub Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-457 (Use of Uninitialized Variable) and CWE-824 (Access of Uninitialized Pointer). In channels/urbdrc/client/data_transfer.c, the function urb_write_completion reserves OutputBufferSize bytes in the output stream using Stream_Seek, which only advances the stream position without zeroing or writing the reserved region. When a USB control transfer IN fails (e.g., LIBUSB_ERROR_PIPE) or returns fewer bytes than declared, the reserved space is never populated with device data, so the completion PDU is sent to the server containing stale heap bytes — including live heap and library pointers — from the client process's backing allocation. The same uninitialized-reserve pattern exists in a second completion path at data_transfer.c:892/893. Exploitation requires the victim to have USB redirection active (e.g., xfreerdp /usb:... or the usb option in a Remmina profile) with a device redirected; on Linux, the client typically needs root or libusb-level access to the USB node (FreeRDP Advisory).

The primary impact is a high-severity confidentiality breach: a malicious RDP server can recover tens of kilobytes of client heap memory per session, including live pointers that reveal the client's heap base (connect_base) and libc base address (including the address of system). This effectively defeats ASLR on the client. When chained with a companion heap overflow vulnerability (referred to as "Vuln1" in the advisory), a full remote code execution exploit is achievable against the connecting client — confirmed in testing against FreeRDP on Ubuntu 26.04 with ASLR and NX enabled. Integrity and availability are not directly impacted by this vulnerability alone (FreeRDP Advisory, Red Hat Bugzilla).

No confirmed in-the-wild exploitation has been observed, and no standalone weaponized exploit code is publicly available. The FreeRDP security advisory (GHSA-hw7p-5h2r-83gq) includes a proof-of-concept demonstrating the leak and ASLR defeat, but it does not provide a complete end-to-end RCE exploit chain. NVD SSVC classifies exploitation status as "poc." The EPSS score is 0.0, and the vulnerability is not currently listed in the CISA KEV catalog. The attacker must operate a malicious RDP server and requires the victim to connect with USB redirection enabled — user interaction is required (FreeRDP Advisory, GitHub Advisory).

1. Set up a malicious RDP server: The attacker deploys a rogue RDP server (e.g., a modified FreeRDP server or custom implementation) that supports the urbdrc USB redirection channel and is capable of issuing USB IN transfer requests.
2. Lure the victim to connect: The attacker social-engineers or redirects a target user running a vulnerable FreeRDP client (versions 2.0.0–3.30.0) to connect to the malicious server with USB redirection enabled (e.g., via xfreerdp /usb:id,dev:... or a Remmina profile with the usb option).
3. Enumerate and redirect a USB device: Once the client connects and redirects a USB device, the malicious server identifies the redirected device via the urbdrc channel.
4. Induce failing USB IN transfers: The server issues USB control transfer IN requests that are designed to fail (e.g., causing LIBUSB_ERROR_PIPE stalls) or return fewer bytes than declared in OutputBufferSize.
5. Receive uninitialized heap memory: The client's urb_write_completion function sends a completion PDU containing OutputBufferSize bytes of uninitialized heap memory (stale data from the stream's backing allocation), which the server receives and parses.
6. Extract ASLR-defeating pointers: The server scans the received bytes for live heap and library pointers, recovering the client's connect_base (heap/connection arena base) and libc base address (including the address of system), defeating ASLR.
7. Chain with memory corruption for RCE: Using the leaked addresses, the attacker chains this information leak with a companion heap overflow vulnerability to achieve reliable remote code execution on the client (FreeRDP Advisory).

• Network: Outbound RDP connections (TCP/3389 or custom port) from client systems to unknown or untrusted RDP server IPs, particularly where USB redirection (urbdrc) channel traffic is observed; unusually large urbdrc completion PDUs being sent from client to server.
• Process: FreeRDP client processes (xfreerdp, xfreerdp3) launched with /usb: arguments or Remmina processes with USB redirection profiles connecting to external or unrecognized RDP endpoints.
• Logs: System logs showing FreeRDP USB redirection channel activity (urbdrc) with repeated failed USB transfer completions; libusb error messages (e.g., LIBUSB_ERROR_PIPE) coinciding with RDP sessions to external servers.
• File System: Presence of FreeRDP versions older than 3.31.0 on client systems (check /usr/lib/libfreerdp*.so version or package manager output); Remmina profiles configured with the usb option pointing to external RDP servers (FreeRDP Advisory).

Upgrade FreeRDP to version 3.31.0 or later, which addresses the vulnerability by ensuring that the reserved output buffer region is zeroed (using Stream_Zero instead of Stream_Seek) and that OutputBufferSize is set to 0 on failed or short IN transfers. As a workaround, disable USB redirection entirely by not using the /usb: flag in xfreerdp or removing the usb option from Remmina profiles. Additionally, restrict RDP client connections to only trusted, known-good RDP servers through network segmentation and firewall rules to reduce exposure to malicious servers (FreeRDP Advisory, Red Hat Bugzilla).

The vulnerability was reported by Julien Lair, a Security Researcher at Quarkslab, and disclosed responsibly through FreeRDP's security advisory process. Red Hat has tracked the issue via Bugzilla (Bug 2533930) and classified it as high severity/priority. VulnCheck published an advisory corroborating the affected version range. No significant broader media coverage or notable social media discussion has been identified at this time (FreeRDP Advisory, Red Hat Bugzilla).