CVE-2026-91951

A flaw was found in FreeRDP. A malicious Remote Desktop Protocol (RDP) server can send a specially crafted USB redirection message to the urbdrc client channel. This can trigger an out-of-bounds write, leading to a denial of service (DoS) for the client when verbose asserts are enabled.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the USB redirection (urbdrc) client channel when connecting to untrusted RDP servers. This can typically be achieved by using the /d:urbdrc option with xfreerdp or similar FreeRDP client commands. Disabling this channel will prevent USB device redirection functionality.