Description
FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
Published: 2026-11-03
Score: 2.3 Low
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Update
AI Analysis

Impact

FreeRDP clients from version 3.27.0 up to, but not including, 3.32.2 contain a flaw in the rdpdr_dump_packet routine that allows a remote RDP server to send a malformed RDPDR device‑list announcement. The announcement can specify a DeviceDataLength larger than the actual packet payload, which triggers a fatal Stream_Seek assertion when device‑redirection, TRACE logging, or WinPR assertions are enabled. This assertion forces the client process to terminate, resulting in a denial of service for the user.

Affected Systems

All FreeRDP client builds from version 3.27.0 through 3.31.x are affected. The vulnerability is limited to client installations with device‑redirection or TRACE logging enabled. Releases 3.32.2 and newer are not impacted.

Risk and Exploitability

The risk is low, with a CVSS score of 2.3, no EPSS data, and it is not listed in the CISA KEV catalog. The attack requires an attacker to control or impersonate an RDP server and send a malformed device‑list announcement; no privilege escalation beyond the client is needed. The resulting denial of service is limited to the client process, curtailing availability for the user.

Generated by OpenCVE AI on November 3, 2026 at 16:29 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the FreeRDP client to version 3.32.2 or later to eliminate the flaw.
  • If an upgrade is not possible, configure the client to disable device‑redirection and TRACE logging so that the assertion is never triggered.
  • If both upgrading and disabling features are infeasible, monitor RDP traffic for malformed device‑list announcements from untrusted servers and block such sources to prevent the assertion from being triggered.

Generated by OpenCVE AI on November 3, 2026 at 16:29 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 03 Nov 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 03 Nov 2026 14:45:00 +0000

Type Values Removed Values Added
Description FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious RDP servers to abort clients by sending malformed RDPDR device-list announcements. Attackers can declare a DeviceDataLength exceeding the received packet, triggering a fatal Stream_Seek assertion when device redirection, TRACE logging, and WinPR assertions are enabled.
Title FreeRDP 3.27.0 before 3.32.2 Client DoS via RDPDR Device Announcement Logging
First Time appeared Freerdp
Freerdp freerdp
Weaknesses CWE-617
CPEs cpe:2.3:a:freerdp:freerdp:*:*:*:*:*:*:*:*
Vendors & Products Freerdp
Freerdp freerdp
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Freerdp Freerdp
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-11-03T16:01:08.967Z

Reserved: 2026-11-03T12:26:31.384Z

Link: CVE-2026-121389

cve-icon Vulnrichment

Updated: 2026-11-03T16:01:04.239Z

cve-icon NVD

Status : Analyzed

Published: 2026-11-03T15:17:26.167

Modified: 2026-11-03T21:13:36.777

Link: CVE-2026-121389

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T17:00:16Z

Weaknesses