CVE-2026-91963
FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.64%
- CWE
- CWE-457
- Published
- 2026-09-15
- Last modified
- 2026-09-15
Affected products
- FreeRDP FreeRDP
- FreeRDP FreeRDP
- FreeRDP FreeRDP
- FreeRDP FreeRDP
Weakness type
Related vulnerabilities
- CVE-2026-78935 — Use of uninitialized variable in Mobile in Google Chrome on on iOS prior to 152.0.7977.65 allowed a remote attacker to p
- CVE-2026-14405 — Uninitialized Use in V8 in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to execute arbitrary code insi
- CVE-2024-7022 — Uninitialized Use in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memor
- CVE-2026-13825 — Uninitialized Use in Dawn in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to potentially exploit heap
- CVE-2024-10934 — OpenBSD NFS double-free vulnerability
- CVE-2022-40510 — Buffer copy without checking size of input in Audio.
- CVE-2026-14413 — Uninitialized Use in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker who had compromised the ren
- CVE-2026-10960 — Uninitialized Use in Codecs in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the re