FreeRDP EUVD-2026-115942

The victim's FreeRDP client must initiate a connection to a malicious or compromised RDP server with the RDPGFX graphics pipeline active (AUTODETECT enables it in the assessed client source). The server must open the RDPGFX dynamic channel, create a valid surface, and then send a crafted uncompressed ALPHA WIRETOSURFACE_2 PDU (payload 4c 41 00 00) carrying zero width and zero height, which passes zero as an element size to Stream_CheckAndLogRequiredLengthEx. Limiting factors: exploitation is client-side and requires a user-initiated connection to the attacker's server (UI:P), not a push against a listening service; the confirmed session termination was observed only on builds compiled with verbose WINPR assertions, and on builds without that assertion the termination relies on a subsequent division-by-zero that the advisory describes as plausible but did not execute in the preserved live test.

This is a medium-severity, client-side denial-of-service issue, not a high-priority emergency. The CVSS 4.0 base score of 5.3 is consistent with the vector: AV:N but UI:P means exploitation flows in the reverse direction - a FreeRDP client must itself connect to an attacker-controlled or compromised RDP server, and the only impact is availability (VA:L); there is no confidentiality or integrity impact and no demonstrated memory corruption or code execution. PR:N indicates no authentication to the malicious server is needed. The vuln.today decision label is 'this_month' (not act_now/emergency), and the issue is not listed in CISA KEV; no EPSS probability was supplied in the input, so widespread-exploitation likelihood cannot be quantified from the data. A public PoC reference exists but it is a handler-level reproducer plus a documented live wire command, not a verified standalone live RDP-server exploit. A key caveat weakens real-world impact: the confirmed client abort (exit 134) was observed only on verbose-WINPR-assert builds via WINPR_ASSERT(size > 0); in production builds without that assertion, termination depends on a following division-by-zero that the advisory calls plausible but states was not executed in the preserved live test. One data conflict must be flagged: the CVE description and package metadata say the flaw is fixed in 3.32.2, while the GHSA advisory body states 'No fixed release was identified' - treat 3.32.2 as the fix but verify, as the advisory text may predate the release.

An attacker lures or redirects a victim running a FreeRDP-based client (with the RDPGFX graphics pipeline active) into connecting to a malicious or compromised RDP server. After the graphics channel is up and a surface is created, the server sends a crafted ALPHA WIRETOSURFACE_2 PDU (payload 4c 41 00 00) with zero width and height, terminating the victim's client session. A public handler-level PoC reference exists but is not verified as a working live-server exploit; attack complexity is low (AC:L) but it requires the victim to initiate the connection (UI:P).