FreeRDP CVE-2026-109240

Exploitation requires a 'reverse RDP' setup: the FreeRDP client (version 3.11.0 through before 3.32.1) must connect to an attacker-controlled or compromised RDP server, and the USB device redirection channel (URBDRC) must be active so the server can send an IN-direction TS_URB_ISOCH_TRANSFER request carrying an OutputBufferSize value above INT32_MAX, which reaches the assertion in libusb_udev_isoch_transfer. Limiting factors that reduce real-world risk: the attack is entirely client-side and cannot be launched against a listening service; it depends on the victim initiating/accepting a connection to the malicious server (passive user interaction, UI:P); the USB-redirection feature must be in use; and the impact is confined to a recoverable client crash with no code execution or data exposure.

This is a genuinely low-priority issue despite affecting a widely-used component. The vendor-assigned CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N) scores only 2.3, and the signals are internally consistent: the sole impact is low availability loss (VA:L) - a client-side crash with no confidentiality or integrity effect (VC:N/VI:N). Critically, this is a 'reverse RDP' flaw: the attacker must operate or compromise an RDP server and the victim must connect to it (UI:P - passive user interaction required), with an additional attack requirement (AT:P) that the vulnerable USB-redirection path (URBDRC) be exercised. No EPSS score was provided, the CVE is NOT in CISA KEV, and no public exploit code is referenced - so there is no evidence of active exploitation or weaponization. The practical outcome is a recoverable denial of service (the client terminates via assertion) against users who initiate connections to malicious servers, not a server-side or wormable condition. No key signals conflict here; the main gap is the absence of EPSS data, but given the DoS-only impact and required victim interaction, real-world urgency is minimal.

An attacker stands up a malicious RDP server (or compromises a legitimate one) and lures a FreeRDP-based client to connect, e.g. via a phishing link or a rogue remote-desktop gateway. Once the USB-redirection (URBDRC) channel is active, the server sends an IN-direction TS_URB_ISOCH_TRANSFER request with an OutputBufferSize above INT32_MAX, triggering a reachable assertion in libusb_udev_isoch_transfer and crashing the victim's client. No public exploit code is referenced in the provided data.