CVE-2026-109240: FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over URBDRC, triggering an assertion in libusbudevisochtransfer that terminates the client.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.1+dfsg-1 - Upgrade
Upgrade
debian/freerdp3to a version that resolves this vulnerability.Fixed in 3.32.2+dfsg-1Fixed in 3.33.0+dfsg-1
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
FreeRDP versions from 3.11.0 before 3.32.1 are affected. Exposure occurs when a client connects to a malicious RDP server that can send URBDRC traffic.
What must an attacker do to trigger the denial of service?
The attacker must operate or control an RDP server and send a TS_URB_ISOCH_TRANSFER request in the IN direction with an OutputBufferSize greater than INT32_MAX. Exploitation also requires a user to connect the FreeRDP client to that server.
What is the effect of successful exploitation?
The malformed request triggers an assertion in libusb_udev_isoch_transfer, terminating the FreeRDP client. The provided information indicates a client denial of service, with no confidentiality or integrity impact.