GHSA-4v4p-9v5x-hc93: FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks

Q: Which deployments are exposed?

FreeRDP clients prior to 3.24.2 are affected when they use RPC-over-HTTP transport through an RDP Gateway. The assertion is enabled in default release builds.

Q: What does an attacker need to exploit this issue?

An attacker needs to operate or control a malicious RDP Gateway that a FreeRDP client connects through. Exploitation occurs before authentication and requires user interaction to initiate the connection.

Q: What is the impact of successful exploitation?

A crafted network auth_length value triggers a WINPR_ASSERT() failure, causing the FreeRDP client process to terminate with SIGABRT. This is a denial-of-service impact on the client.

Q: How can this be remediated?

Upgrade FreeRDP to version 3.24.2, which includes the patch.

Published Mar 30, 2026

Updated

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated authlength field read from the network triggers a WINPRASSERT() failure in rtsreadauthverifiernochecks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecting all FreeRDP clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds (WITHVERBOSEWINPRASSERT=ON). This issue has been patched in version 3.24.2.

Affected Software

1 affected component

FreeRDP freerdp<3.24.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade FreeRDP to a version that resolves this vulnerability.
Fixed in 3.24.2

Event History

Mar 30, 2026

CVE Published

via OSV·09:42 PM

Data Sourced

via OSV·09:42 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

FreeRDP clients prior to 3.24.2 are affected when they use RPC-over-HTTP transport through an RDP Gateway. The assertion is enabled in default release builds.

What does an attacker need to exploit this issue?

An attacker needs to operate or control a malicious RDP Gateway that a FreeRDP client connects through. Exploitation occurs before authentication and requires user interaction to initiate the connection.

What is the impact of successful exploitation?

A crafted network auth_length value triggers a WINPR_ASSERT() failure, causing the FreeRDP client process to terminate with SIGABRT. This is a denial-of-service impact on the client.

How can this be remediated?

Upgrade FreeRDP to version 3.24.2, which includes the patch.

GHSA-4v4p-9v5x-hc93: FreeRDP: DoS via WINPR_ASSERT in rts_read_auth_verifier_no_checks

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

How can this be remediated?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

What is the impact of successful exploitation?

How can this be remediated?