CVE-2026-109240: FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

Q: Which deployments are exposed to this issue?

FreeRDP versions from 3.11.0 before 3.32.1 are affected. Exposure occurs when a client connects to a malicious RDP server that can send URBDRC traffic.

Q: What must an attacker do to trigger the denial of service?

The attacker must operate or control an RDP server and send a TS_URB_ISOCH_TRANSFER request in the IN direction with an OutputBufferSize greater than INT32_MAX. Exploitation also requires a user to connect the FreeRDP client to that server.

Q: What is the effect of successful exploitation?

The malformed request triggers an assertion in libusb_udev_isoch_transfer, terminating the FreeRDP client. The provided information indicates a client denial of service, with no confidentiality or integrity impact.

Published Oct 12, 2026

Updated

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over URBDRC, triggering an assertion in libusbudevisochtransfer that terminates the client.

Affected Software

1 affected component

FreeRDP freerdp>=3.11.0<3.32.1

Event History

Oct 12, 2026

CVE Published

via MITRE·04:04 PM

Data Sourced

via MITRE·04:04 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed to this issue?

FreeRDP versions from 3.11.0 before 3.32.1 are affected. Exposure occurs when a client connects to a malicious RDP server that can send URBDRC traffic.

What must an attacker do to trigger the denial of service?

The attacker must operate or control an RDP server and send a TS_URB_ISOCH_TRANSFER request in the IN direction with an OutputBufferSize greater than INT32_MAX. Exploitation also requires a user to connect the FreeRDP client to that server.

What is the effect of successful exploitation?

The malformed request triggers an assertion in libusb_udev_isoch_transfer, terminating the FreeRDP client. The provided information indicates a client denial of service, with no confidentiality or integrity impact.

CVE-2026-109240: FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the denial of service?

What is the effect of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

What must an attacker do to trigger the denial of service?

What is the effect of successful exploitation?