Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91963FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc
Medium 6.5
In plain English
A medium-severity security flaw in FreeRDP from FreeRDP. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux:10 | freerdp | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:8 | freerdp | 2:2.11.7-14.el8_10 | ALSA-2026:76747 |
| AlmaLinux:9 | freerdp | 2:2.11.7-7.el9_8.8 | ALSA-2026:76755 |
| AlmaLinux:10 | freerdp-devel | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:8 | freerdp-devel | 2:2.11.7-14.el8_10 | ALSA-2026:76747 |
| AlmaLinux:9 | freerdp-devel | 2:2.11.7-7.el9_8.8 | ALSA-2026:76755 |
| AlmaLinux:10 | freerdp-libs | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:8 | freerdp-libs | 2:2.11.7-14.el8_10 | ALSA-2026:76747 |
| AlmaLinux:9 | freerdp-libs | 2:2.11.7-7.el9_8.8 | ALSA-2026:76755 |
| AlmaLinux:10 | freerdp-server | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:10 | libwinpr | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:8 | libwinpr | 2:2.11.7-14.el8_10 | ALSA-2026:76747 |
| AlmaLinux:9 | libwinpr | 2:2.11.7-7.el9_8.8 | ALSA-2026:76755 |
| AlmaLinux:10 | libwinpr-devel | 2:3.10.3-12.el10_2.14 | ALSA-2026:75570 |
| AlmaLinux:8 | libwinpr-devel | 2:2.11.7-14.el8_10 | ALSA-2026:76747 |
| AlmaLinux:9 | libwinpr-devel | 2:2.11.7-7.el9_8.8 | ALSA-2026:76755 |
| Debian:12 | freerdp2 | no fix listed | DEBIAN-CVE-2026-91963 |
| Debian:13 | freerdp3 | no fix listed | DEBIAN-CVE-2026-91963 |
| Debian:14 | freerdp3 | 3.31.0+dfsg-1 | DEBIAN-CVE-2026-91963 |
| Rocky Linux:10 | freerdp | 2:3.10.3-12.el10_2.14 | RLSA-2026:75570 |
| Rocky Linux:8 | freerdp | 2:2.11.7-14.el8_10 | RLSA-2026:76747 |
| Rocky Linux:9 | freerdp | 2:2.11.7-7.el9_8.8 | RLSA-2026:76755 |
| Ubuntu:22.04:LTS | freerdp2 | no fix listed | UBUNTU-CVE-2026-91963 |
| Ubuntu:24.04:LTS | freerdp3 | 3.31.0+dfsg-0ubuntu0.24.04.1 | UBUNTU-CVE-2026-91963 |
| Ubuntu:26.04:LTS | freerdp3 | 3.31.0+dfsg-0ubuntu0.26.04.1 | UBUNTU-CVE-2026-91963 |
Affected products (as reported)
Weakness: CWE-457 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- GitHub Security Advisory (GHSA-hw7p-5h2r-83gq) vendor-advisory
- VulnCheck Advisory: FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc third-party-advisory