CVE-2026-109240

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...

CVE-2026-109240 FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer

FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urbisochtransfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TSURBISOCHTRANSFER IN-direction request with OutputBufferSize above INT32MAX over...

CVE-2026-109240

FreeRDP versions 3.11.0 before 3.32.1 are vulnerable to a reachable assertion vulnerability within the urb_isoch_transfer function. A malicious RDP server can cause a client to crash by sending a TS_URB_ISOCH_TRANSFER IN-direction request over URBDRC containing an unvalidated OutputBufferSize val...