CVE-2026-91963

A flaw was found in FreeRDP. An uninitialized heap memory disclosure vulnerability exists in the urbdrc USB redirection channel. A malicious Remote Desktop Protocol (RDP) server can exploit this by inducing failing USB transfers, allowing it to read uninitialized heap memory from the client. This information disclosure can defeat Address Space Layout Randomization (ASLR), potentially enabling remote code execution when chained with other memory corruption vulnerabilities.

This vulnerability is rated as Important severity because an attacker controlling a rogue RDP server can extract sensitive pointer information from client heap memory, effectively neutralizing ASLR defenses to facilitate reliable code execution. Exploitation requires user interaction to establish a session with an untrusted host while actively redirecting local USB peripherals. In standard Red Hat Enterprise Linux environments, USB redirection is not enabled by default during client sessions, significantly limiting exposure under typical desktop and workstation usage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To reduce exposure, avoid connecting to untrusted RDP servers or disable the FreeRDP USB redirection channel if it is not required. When using the xfreerdp client, ensure that USB redirection is not enabled. This can be done by omitting the /usb or /usb-redir command-line options, or by explicitly disabling the urbdrc channel through FreeRDP configuration if available. Disabling this feature will prevent the redirection of USB devices to the remote session.