FreeRDP EUVD-2026-115927

Three concrete prerequisites must all hold: (1) the FreeRDP client must be compiled with WITH_VERBOSE_WINPR_ASSERT=ON, which is NOT the default - the advisory confirms the OFF build does not crash; (2) the victim must initiate an RDP connection to an attacker-controlled or attacker-relayed server (UI:P); and (3) the session must negotiate the classic RemoteFX surface-bits path (e.g. /sec:rdp +rfx -gfx), not the GFX pipeline. Limiting factors: the non-default build flag excludes virtually all standard distribution packages; impact is limited to a client process abort with no confidentiality, integrity, memory-corruption, or code-execution consequence; and no server-side or default-config exposure exists.

The CVSS 4.0 score of 7.1 is driven entirely by availability (VA:H) of the FreeRDP client process; there is no confidentiality or integrity impact (VC:N/VI:N) and the advisory explicitly states no memory corruption. The single most important limiter, confirmed by the GHSA advisory's own validation, is that the crash occurs ONLY in client builds compiled with WITH_VERBOSE_WINPR_ASSERT=ON - a non-default developer/debug option. The matched build with WITH_VERBOSE_WINPR_ASSERT=OFF did not crash and ran until the test timeout, so standard distribution builds are not affected. No EPSS score and no KEV listing were provided; there is no indication of active exploitation. A complete, validated PoC exists in the public GHSA advisory (client exited status 134 at rfx_differential.h:34). The vuln.today priority is this_week, not act_now/emergency. Net: despite a 'High' numeric score this is a client-side denial of service gated on a non-default build flag plus victim-initiated connection to a malicious server, making it a low real-world priority for the overwhelming majority of deployments running standard builds - while legitimately relevant to anyone shipping verbose-assert-enabled builds. Note a data conflict on fix availability (see confidence_notes).

An attacker stands up (or compromises/relays into) a malicious RDP server and induces a victim to connect with a FreeRDP-based client that was built with verbose WinPR assertions enabled and negotiates the classic RemoteFX surface-bits path. The server sends a crafted RemoteFX tile whose two adjacent LL3 coefficients each decode to 20,000; the differential decoder sums them to 40,000, failing the signed-16-bit assertion and aborting the client. A full working PoC (a loopback relay injecting the tile) is published in the GHSA advisory.