FreeRDP EUVD-2026-115921

Exploitation requires ALL of the following simultaneously: (1) the victim must connect to an attacker-controlled or malicious RDP server (no auth bypass is involved); (2) device redirection must be enabled on the client (e.g., xfreerdp /drive:tmp,/tmp), so an active RDPDR channel is reached; (3) the RDPDR logger must be at TRACE level (e.g., /log-level:TRACE) - at INFO the diagnostic packet dump is skipped and the crash does not occur; and (4) the client must be built with active WinPR assertions (e.g., WITH_VERBOSE_WINPR_ASSERT=ON) - with assertions disabled the same malformed packet did not abort. Limiting factors: default release builds ship with assertions off and default logging is not TRACE, so stock production clients are not affected; the required user-initiated connection and non-default logging/build configuration make this a narrow, configuration-dependent client-side DoS rather than a broadly exploitable condition.

This is a low real-world priority despite being a network-reachable flaw. The CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:P, VA:L, score 2.3) and the vuln.today 'monitor' decision label agree: impact is availability-only (a single client process abort), and exploitation is gated by high attack complexity, a specific attack requirement (AT:P), and required user interaction (the victim must initiate a connection to an attacker-controlled server). The three simultaneous prerequisites - device redirection enabled, RDPDR logging at TRACE, and a build with active WinPR assertions - are not present in default release builds, so the realistic exploitable population is far smaller than the affected-version range suggests. A full reproduction PoC exists in the GHSA advisory, but no KEV listing and no EPSS score were provided in the input, so there is no signal of active or widespread exploitation. The signals are internally consistent (low CVSS, monitor label, availability-only, narrow conditions); the one conflict is remediation data (see confidence_notes), not risk. Net: a genuine but minor client-side DoS, not an emergency.

An attacker stands up or compromises an RDP server and lures a victim into connecting with a FreeRDP client that has drive redirection enabled, TRACE-level RDPDR logging, and an assertion-enabled build. After channel activation the server sends a malformed PAKID_CORE_DEVICELIST_ANNOUNCE whose DeviceDataLength exceeds the packet; the diagnostic dumper's Stream_Seek assertion fails and the client process aborts. A working end-to-end PoC relay script is published in the advisory, but the required non-default logging and assertion build sharply limit real victims.