FreeRDP up to 3.24.1 rts_read_auth_verifier_no_checks auth_length assertion

Summaryinfo

A vulnerability has been found in FreeRDP up to 3.24.1 and classified as problematic. The impacted element is the function rts_read_auth_verifier_no_checks. Performing a manipulation of the argument auth_length results in assertion. This vulnerability was named CVE-2026-33952. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in FreeRDP up to 3.24.1. It has been classified as problematic. This affects the function rts_read_auth_verifier_no_checks. The manipulation of the argument auth_length with an unknown input leads to a assertion vulnerability. CWE is classifying the issue as CWE-617. The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary. This is going to have an impact on availability. The summary by CVE is:

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecting all FreeRDP clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds (WITH_VERBOSE_WINPR_ASSERT=ON). This issue has been patched in version 3.24.2.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-33952 since 03/24/2026. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 306291 (Amazon Linux 2 : freerdp, --advisory ALAS2-2026-3238 (ALAS-2026-3238)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.24.2 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (306291), EUVD (EUVD-2026-17221) and CERT Bund (WID-SEC-2026-0880). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Affected

• Amazon Linux 2
• Red Hat Enterprise Linux
• Fedora Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source FreeRDP

Productinfo

Type

• Remote Access Software

Name

• FreeRDP

Version

• 3.24.0
• 3.24.1

License

• open-source

Website

• Product: https://github.com/FreeRDP/FreeRDP/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion