CVE-2026-33952 in FreeRDP

Resumen (Inglés)

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecting all FreeRDP clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds (WITH_VERBOSE_WINPR_ASSERT=ON). This issue has been patched in version 3.24.2.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Responsable

GitHub_M

Reservar

2026-03-24

Divulgación

2026-03-31

Estado

Confirmado

Voces

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidad	CWE	Exp	Con	CVE
354273	FreeRDP rts_read_auth_verifier_no_checks denegación de servicio	617	No está definido	Arreglo oficial	CVE-2026-33952

Fuentes

• MITRE
• NVD
• CVE Details