CVE-2026-109240
Received Received - Intake

FreeRDP Remote Desktop Client Assertion Failure via Malicious RDP Server

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request with OutputBufferSize above INT32_MAX over URBDRC, triggering an assertion in libusb_udev_isoch_transfer that terminates the client.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-12
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109240
EUVD
EUVD-2026-97684

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
FreeRDP FreeRDP 3.11.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a reachable assertion flaw in FreeRDP versions 3.11.0 through 3.32.0. A malicious RDP server can crash the client by sending a specially crafted TS_URB_ISOCH_TRANSFER IN-direction request with an OutputBufferSize value exceeding INT32_MAX. This triggers an assertion failure in libusb_udev_isoch_transfer, causing the client to terminate unexpectedly.

Detection Guidance

Monitor FreeRDP client crashes during RDP sessions. Check logs for assertion failures in libusb_udev_isoch_transfer. Inspect network traffic for TS_URB_ISOCH_TRANSFER packets with OutputBufferSize exceeding INT32_MAX.

Impact Analysis

The impact is a denial-of-service condition where a malicious or compromised RDP server can crash the FreeRDP client. This disrupts remote desktop sessions and may lead to loss of access to the affected system until the client is restarted.

Mitigation Strategies

Upgrade FreeRDP to version 3.32.1 or later. Apply patches from FreeRDP's security advisory. Restrict RDP server connections to trusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart