FreeRDP EUVD-2026-115925

Exploitation requires ALL of the following: the victim's FreeRDP client must be compiled with WITH_VERBOSE_WINPR_ASSERT=ON (the advisory confirms builds with this flag OFF do not crash - a strong limiting factor, as this is not a typical release default); the user must actively connect to an attacker-controlled or attacker-redirected RDP server (UI:P); and the session must negotiate classic RemoteFX graphics (validated with /sec:rdp +rfx -gfx). The attacker then sends a RemoteFX region rectangle with x=65535 while the RDP SurfaceBits destination begins at left=1, so their sum exceeds the 16-bit coordinate assertion in rfx_process_message. Affected versions are FreeRDP 3.0.0 through 3.32.1; FreeRDP 2.x is not affected. Impact is limited to a crash of the connecting client process only - no server, other-client, data, or memory-corruption impact. Note the server-side -auth flag in the PoC is a reproduction convenience, not a precondition that deployments must disable authentication.

This is a client-side denial-of-service (CWE-617 reachable assertion) whose real-world priority is moderate and heavily gated by build configuration. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H) correctly captures a network-reachable, low-complexity attack with no confidentiality or integrity impact and availability loss confined to a single client process; the attacker supplies the malicious RDP server and needs no credentials of their own, but the victim must actively connect (UI:P). The score of 7.1 overstates operational urgency for two reasons grounded in the advisory: (1) the crash only occurs in clients compiled with WITH_VERBOSE_WINPR_ASSERT=ON - the advisory confirms a build with that flag OFF stayed active against the same malformed packet - and verbose WinPR assertions are not the typical release-build default; and (2) impact is explicitly limited to loss of availability of the connecting client process, with no data disclosure, no memory corruption, and no effect on the server or other clients. VulnCheck assigned a 'this_week' priority and published a validated proof-of-concept, so exploit knowledge is public. No EPSS score is provided in the input, and the CVE is not listed in CISA KEV, so there is no evidence of active exploitation - treat this as a public-PoC availability issue rather than confirmed in-the-wild abuse. Net: a legitimate but non-emergency patch item, most relevant to environments that ship or self-compile assertion-enabled FreeRDP builds.

An attacker stands up (or compromises/redirects a victim to) a malicious RDP server, lures a user into connecting with a FreeRDP-based client that negotiates classic RemoteFX, and then injects a crafted RemoteFX region update. A rectangle with x=65535 combined with a SurfaceBits destination left=1 overflows a 16-bit coordinate check, tripping the assertion in rfx_process_message and terminating the client process. A complete, reporter-validated proof-of-concept relay script is published in the GHSA advisory; it reliably aborts an assertion-enabled client (exit 134) while a control input leaves the client running.