CVE-2026-91963CWE-457

CVE-2026-91963

Medium · published September 15, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
51.2
In the wild
Unconfirmed
What it is

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00665 · 51.2th percentile
Weakness
CWE-457 · Use of Uninitialized Variable
Published
2026-09-15T20:17Z
Affected products (1)
ProductVersionsFixed in
freerdp/freerdp≥ 2.0.0, < 3.31.03.31.0
References (3)
https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq · [email protected]https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrc · [email protected]https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 SEP 03:33Z
    EPSS moved — → 1%
    epss
  • 15 SEP 15:18Z
    FreeRDP 2.0.0 through 3.30.0 Uninitialized Heap Memory Disclosure via urbdrc
    cvelistv5