CVE-2026-24679 is a critical (CVSS 9.1) out-of-bounds read in the FreeRDP URBDRC client, which handles USB redirection. It uses server supplied interface numbers as array indices without bounds checks. Versions up to 3.21.0 are affected, and 3.22.0 fixes it. Upgrade FreeRDP.
What's affected
The GitHub advisory lists FreeRDP 3.21.0 and earlier as affected, and 3.22.0 as patched.
The URBDRC client takes interface numbers from the server and uses them as array indices, with no bounds checks, in libusb_udev_select_interface. The result is an out-of-bounds read. The risk is on the client side, when it connects to a malicious or compromised server with USB redirection enabled.
It shipped with CVE-2026-24677, another FreeRDP flaw fixed in 3.22.0.
How to check if you're exposed
Check the FreeRDP version:
xfreerdp /version
Then look at your package manager and software inventory for libfreerdp and for tools that embed it. Container images that include a remote desktop client count too.
For a quick look at your own dependencies, Safeguard's free in-browser dependency scan at https://gold.safeguard.sh/scan checks them against known CVEs in your browser.
What to do now
- Upgrade FreeRDP to 3.22.0 or later.
- Update tools and images that bundle FreeRDP.
- Do not enable USB redirection to servers you do not trust.
- Connect only to RDP servers you control or trust.
Why it matters
The record lists CWE-122, heap based buffer overflow, while the advisory describes an out-of-bounds read from untrusted indices. A number from the network picks a slot in an array, and nothing checks that the slot exists. The fix is bounds checking before the index is used.
Protocol clients are easy to forget in a vulnerability program because they are not services. When they parse data from remote servers, they deserve the same attention. The CVE is not in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Does it affect servers?
The flaw is in the FreeRDP client's handling of data from the server.
What fixes it?
FreeRDP 3.22.0.
Sources
Last reviewed: 19 October 2026.
