Use of uninitialized resource in FreeRDP - CVE-2026-91963

Vulnerability identifier: #VU146598

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-91963

CWE-ID: CWE-908

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to use of uninitialized resource in the urbdrc USB redirection path when handling failed or short USB control transfer IN completions. A remote attacker can issue crafted IN transfers through a malicious RDP server to disclose sensitive information.

USB redirection must be active and a USB device must be redirected for exploitation to succeed.

FreeRDP
openEuler
freerdp
libwinpr-devel
libwinpr
freerdp-help
freerdp-devel
freerdp-debugsource
freerdp-debuginfo

Install security update from vendor's website.

FreeRDP - update to 3.31.0
freerdp - update to 2.11.8-11
libwinpr-devel - update to 2.11.8-11
libwinpr - update to 2.11.8-11
freerdp-help - update to 2.11.8-11
freerdp-devel - update to 2.11.8-11
freerdp-debugsource - update to 2.11.8-11
freerdp-debuginfo - update to 2.11.8-11

• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gq

• Multiple vulnerabilities in FreeRDP
• openEuler 24.03 LTS SP4 update for freerdp
• openEuler 24.03 LTS SP3 update for freerdp
• openEuler 24.03 LTS SP1 update for freerdp
• openEuler 22.03 LTS SP4 update for freerdp