Reachable assertion in FreeRDP - #VU156158
Published: October 19, 2026
Vulnerability identifier: #VU156158
CSH Severity: Low
CVSS v4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by terminating the FreeRDP client process.
The vulnerability exists due to a reachable assertion in the rdpdr_dump_packet function when processing a malformed RDPDR device-list announcement with an unchecked device-data length. A remote attacker can send an announcement with DeviceDataLength exceeding the remaining packet data from a malicious server selected by the victim to trigger a fatal Stream_Seek assertion and abort the client process.
The demonstrated abort requires device redirection to be enabled, RDPDR TRACE logging to be active, and WinPR assertions to be enabled in the client build.
Affected software
FreeRDP
Remediation
Install security update from vendor's website.
FreeRDP - update to 3.32.2