CVE-2026-91963

Name of the Vulnerable Software and Affected Versions FreeRDP versions prior to 3.31.0

Description An uninitialized heap memory disclosure exists in the urbdrc USB redirection channel. A malicious RDP server can trigger failing USB transfers to read uninitialized heap memory from the client. This can be used to bypass ASLR (Address Space Layout Randomization), a security technique that randomly arranges the address space positions of key data areas, and may enable remote code execution when combined with memory corruption issues.

Recommendations Update to version 3.31.0 or later.