Reachable assertion in FreeRDP - #VU156160
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by terminating a FreeRDP client's RDP session.
The vulnerability exists due to a reachable assertion in FreeRDP's RDPGFX ALPHA processing when handling a WIRETOSURFACE_2 command with zero surface-command dimensions. A remote attacker can induce a client with the graphics pipeline enabled to connect to a malicious RDP server, create a valid graphics surface, and send an ALPHA WIRETOSURFACE_2 command containing the four-byte bitmap payload 4c 41 00 00 to trigger the WINPR_ASSERT(size > 0) assertion in Stream_CheckAndLogRequiredLengthEx and abort the client.
The observed crash was in a verbose-assert build; termination without that assertion was not verified.