Description
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request with OutputBufferSize above INT32_MAX over URBDRC, triggering an assertion in libusb_udev_isoch_transfer that terminates the client.
Published: 2026-10-12
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

FreeRDP clients from version 3.11.0 through 3.32.0 contain a reachable assertion in the urb_isoch_transfer function that allows a malicious remote desktop protocol server to cause the client to crash by sending an oversized OutputBufferSize value over the URBDRC channel. The assertion failure terminates the client process, resulting in a denial of service for users. The flaw is a classic uncontrolled resource consumption weakness identified as CWE-617.

Affected Systems

The affected product is FreeRDP Client. All releases from 3.11.0 up to, but not including, 3.32.1 are vulnerable. Systems running any of these FreeRDP versions on Windows, Linux, or macOS that connect to remote servers are potentially impacted.

Risk and Exploitability

The CVSS base score is 2.3, indicating a low severity vulnerability; there is no documented exploit probability or listing in the CISA KEV catalog. Attackers must control a remote RDP server and send specially crafted TS_URB_ISOCH_TRANSFER requests with an OutputBufferSize larger than INT32_MAX. If successful, the client crashes, causing a local denial of service to the user or the system running the client.

Generated by OpenCVE AI on October 12, 2026 at 17:52 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FreeRDP client to version 3.32.1 or later to remove the vulnerable assertion.
  • Restrict outbound RDP client connections to trusted servers or use network segmentation and firewall rules to limit exposure to malicious hosts.
  • Monitor client systems for abnormal crashes or repeated assertion failures that may indicate an attempt to exploit this vulnerability.

Generated by OpenCVE AI on October 12, 2026 at 17:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 14 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Low

Tue, 13 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Mon, 12 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request with OutputBufferSize above INT32_MAX over URBDRC, triggering an assertion in libusb_udev_isoch_transfer that terminates the client.
Title FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-617
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-13T18:00:17.250Z

Reserved: 2026-10-12T14:07:56.520Z

Link: CVE-2026-109240

cve-icon Vulnrichment

Updated: 2026-10-13T18:00:11.373Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-12T17:17:14.720

Modified: 2026-11-03T21:33:30.957

Link: CVE-2026-109240

cve-icon Redhat

Severity : Low

Publid Date: 2026-10-12T16:04:17Z

Links: CVE-2026-109240 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-12T18:00:03Z

Weaknesses