FreeRDP EUVD-2026-115941

Two concrete routes, both requiring a routing token whose X.224 length indicator exceeds 255 (empirically 240 bytes with the default 8-byte RDP_NEG_REQ; 239 does not trigger). Route 1 (direct client): the client must connect to a malicious or compromised RDP server that returns a Server Redirection PDU with an oversized LoadBalanceInfo (LB_LOAD_BALANCE_INFO); the client copies it into settings and reuses it as a routing token on reconnect. Route 2 (proxy): freerdp-proxy must be configured with FixedTarget=true (FALSE BY DEFAULT), the front peer must negotiate RDP security WITHOUT an RDP_NEG_REQ, and the outbound leg adds an eight-byte negotiation request, so an unauthenticated front peer sending a recognized 240-247 byte token aborts the proxy. Limiting factors: the proxy route depends on a non-default configuration; default token-derived target selection rejects these long tokens first; the client route requires attacker control of the RDP server and a redirection reconnect; impact is limited to a crash in assertion-enabled builds only.

This is a denial-of-service-only flaw (CWE-617 reachable assertion / CWE-20), and the signals should be read in that light. The vendor CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:N/UI:N) with base score 8.2 looks high, but the entire score is driven by VA:H availability impact with VC:N/VI:N - there is no confidentiality, integrity, or code-execution consequence, so the 8.2 overstates real-world priority for most defenders. AC:H and AT:P correctly reflect that exploitation is not trivial: it needs a specific oversized token (240-247 bytes) and either a malicious/compromised RDP server driving a redirection reconnect, or a proxy explicitly running the non-default FixedTarget=true mode. EPSS is not provided in the input, so exploitation probability cannot be quantified here. The CVE is NOT in CISA KEV and there is no evidence of active exploitation. A public proof-of-concept exists, but it is a component-level parser-to-negotiation harness (plus a separately archived live proxy observation), not a packaged remote exploit; a full malicious-server network run was not preserved. The vuln.today decision label is 'this_week', consistent with a credible, patchable availability bug that warrants scheduled remediation rather than emergency response. Net: a real, confirmed DoS worth patching on a normal cadence, but not a critical breach-class issue despite the 8.2 number.

A victim FreeRDP client connects to an attacker-controlled or compromised RDP server, which returns a Server Redirection PDU carrying an oversized (240+ byte) LoadBalanceInfo; the client stores it and reuses it as an X.224 routing token on reconnect, hitting the tpdu_write_header assertion and aborting. Alternatively, an unauthenticated peer sends a recognized 240-247 byte token to a freerdp-proxy configured with FixedTarget=true, crashing the proxy (exit 134) before any outbound bytes are sent. A component-level public PoC harness reproduces the assertion at 240 bytes (239 does not abort); the high attack complexity reflects the precise token-length threshold and configuration prerequisites.