CVE-2026-91963

mediumpriority · track · 26EPSS 0.007 · 52 %ileDEUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.66% (52nd) EPSS

CVSS 6.5 · medium

Is it mine?

7 products

Check your exposure

Who says so?

2 sources

cert_bund · nvd

EPSS · scored 2026-10-27

FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.

cvss

Technical severity, 0–10. One row per scoring source.

7.1

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.9–7.1

v3.16.5mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:Nprimary · disclosure@vulncheck.comexploitability 2.8 · impact 3.6

v4.07.1highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · disclosure@vulncheck.com

v4.04.9mediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Xsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: poc · Automatable: no · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-457USprimary

affected products (7)

Products and version ranges known to be affected.

Amazon Linux 2all versionscert_bundDEcpe:/o:amazon:linux_2:-
Oracle Linuxall versionscert_bundDEcpe:/o:oracle:linux:-
RESF Rocky Linuxall versionscert_bundDEcpe:/o:resf:rocky_linux:-
Red Hat Enterprise Linuxall versionscert_bundDEcpe:/o:redhat:enterprise_linux:-
Open Source FreeRDP< 3.31.0cert_bundDE
Open Source Open Source FreeRDP <3.31.0< 3.31.0cert_bundDE
freerdp freerdp2.0.0 → 3.31.0nvdUScpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2026-3057FreeRDP: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2026-08-26csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in FreeRDP ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.

sources

Which sources assert this record, and when.

cert_bund nvd NVD CVE.org MITRE

published 2026-09-15modified 2026-09-23

related (438)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2009-0901US	high9.3	36.6% (98th)	—	2009-07-29
The Active Template Library (ATL) in Microsoft Visual Studio .NET 2003 SP1, Visual Studio 2005 SP1 and 2008 Gold, and Visual C++ 2005 SP1 and 2008 Gold and SP1; and Windows 2000 SP…
CVE-2025-54874US	critical9.8	0.63% (50th)	Exploit	2025-08-05
OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is t…
CVE-2007-0214US	high9.3	26.6% (98th)	—	2007-02-13
The HTML Help ActiveX control (Hhctrl.ocx) in Microsoft Windows 2000 SP3, XP SP2 and Professional, 2003 SP1 allows remote attackers to execute arbitrary code via unspecified functi…
CVE-2021-40418US	critical9.8	17.9% (97th)	—	2021-12-22
When parsing a file that is submitted to the DPDecoder service as a job, the R3D SDK will mistakenly skip over the assignment of a property containing an object referring to a UUID…
CVE-2014-4489US	high10.0	3.24% (88th)	—	2015-01-30
IOHIDFamily in Apple iOS before 8.1.3, Apple OS X before 10.10.2, and Apple TV before 7.0.3 does not properly initialize event queues, which allows attackers to execute arbitrary c…

+433 more

references (2) nvd

External citations — patches, advisories, analysis.

https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-hw7p-5h2r-83gqVendor Advisory
https://www.vulncheck.com/advisories/freerdp-2.0.0-through-3.30.0-uninitialized-heap-memory-disclosure-via-urbdrcThird Party Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan