THREATOPS
THREAT OPS › Threat News › [NVD] CVE-2026-91951 (MEDIUM 6.5) — FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-by

[NVD] CVE-2026-91951 (MEDIUM 6.5) — FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-by

mednvdPublished 2026-09-15

CVE-2026-91951 CVSS: 6.5 MEDIUM Published: 2026-09-15T16:17:49.340

FreeRDP versions before 3.31.0 contain an out-of-bounds write vulnerability in the urbdrc client channel's urb_send_current_frame_number_result() function. A malicious RDP server can send a crafted 28-byte USB redirection message to trigger a 4-byte write past the allocated 16-byte buffer, causing denial of service when verbose as

Indicators of compromise

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-91951