CVE-2026-91961
Received Received - Intake

Denial of Service in FreeRDP via libusb Assertion Failure

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulnCheck

Description
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-91961
EUVD
EUVD-2026-78637

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
freerdp freerdp to 3.30.0 (inc)
freerdp freerdp to 3.31.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FreeRDP before version 3.31.0 has a denial-of-service vulnerability in the URBDRC control-transfer request path. The software fails to validate the OutputBufferSize parameter before sending it to the libusb backend. A malicious RDP server can exploit this by sending a request with OutputBufferSize set to 65536, which triggers a reachable assertion that crashes the client process.

Detection Guidance

To detect this vulnerability, monitor FreeRDP client processes for crashes when connecting to an RDP server. Check logs for assertions or errors related to URBDRC or libusb. Use network traffic analysis tools like Wireshark to inspect RDP control-transfer requests for OutputBufferSize values exceeding 65535.

Impact Analysis

This vulnerability allows a remote attacker to crash the FreeRDP client by sending a specially crafted request. If you use FreeRDP versions before 3.31.0, your client may terminate unexpectedly when connecting to a malicious RDP server, leading to denial of service.

Mitigation Strategies

Upgrade FreeRDP to version 3.31.0 or later to patch the vulnerability. If upgrading is not immediately possible, disable the URBDRC channel in FreeRDP client configurations or block RDP connections from untrusted servers until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91961. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart