FreeRDP CVE-2026-121396

Exploitation requires ALL of: (1) the FreeRDP client binary was compiled with WITH_VERBOSE_WINPR_ASSERT=ON - this is not the default for release-style builds, and with it disabled the same packet is rejected cleanly via the ordinary connection-error path with no crash; (2) the victim configures and initiates a client connection through an RD Gateway (type:rpc, RPC-over-HTTP) that the attacker operates, or that the attacker can MITM using a gateway certificate the client accepts; and (3) the vulnerable path is reached only by client-role processes - FreeRDP server, proxy, and shadow roles never enter the gateway RTS parser and are unaffected. No privilege on the client is required (PR:N), but the victim-initiated gateway connection is a mandatory user-interaction gate, and the non-default build option is the dominant real-world limiting factor.

This is a genuinely low-to-medium real-world risk despite a network attack vector. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L, score 5.3) and the GHSA's suggested 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, 6.5) agree on the core mechanism - a single deterministic packet, no privilege, but required user interaction - and disagree only on availability magnitude (VA:L vs A:H), reflecting that the impact is confined to aborting one connecting client process. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a non-urgent but real issue. Three strong limiting signals suppress real-world risk: (1) the crash only occurs on builds compiled with WITH_VERBOSE_WINPR_ASSERT=ON, which is NOT the default for release-style builds - with it disabled the malformed packet is rejected through the normal connection-error path; (2) the attacker must operate (or MITM with an accepted certificate) the exact RD Gateway the victim configures; and (3) only client-role processes are affected - server, proxy, and shadow roles never enter this parser. No EPSS score and no KEV status were provided in the input, so widespread-exploitation probability cannot be quantified from the data here; absence of KEV means no confirmed active exploitation. A public proof-of-concept reproducer is published in the GHSA advisory. CWE-617 (reachable assertion) and the impact classification confirm this is a pure denial of service with no memory corruption, data disclosure, or code execution.

An attacker who controls or can impersonate (via an accepted gateway certificate) the RD Gateway a user has configured waits for the victim to initiate an RDP connection through that gateway. After completing the HTTP NTLM challenge exchange, the gateway sends one crafted RPC-over-HTTP RTS PDU whose declared fragment/auth lengths pass header checks but whose authentication padding byte is inconsistent, aborting the client process. A working PoC reproducer (Python + OpenSSL + Xvfb against an assert-enabled xfreerdp build) is published in the advisory, but exploitation only crashes clients built with verbose WinPR assertions enabled.