CVE-2026-109240— FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
Quick assessment
Affected
FreeRDP FreeRDP
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
FreeRDP 3.11.0 至 3.32.1 版本（不含 3.32.1）中， 函数存在一个可触发的断言（assertion）漏洞。恶意 RDP 服务器可通过发送未经校验的 值导致客户端崩溃。攻击者可通过 URBDRC 发送一条带有 大于 的 TS_URBDRC_ISOCH_TRANSFER 方向为 IN 的请求，从而在 中触发断言失败，导致客户端进程终止。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-109240
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
FreeRDP 3.11.0 before 3.32.1 Reachable Assertion DoS via urb_isoch_transfer
Source: CVE Program / CVE List V5
Vulnerability Description
FreeRDP 3.11.0 before 3.32.1 contains a reachable assertion vulnerability in urb_isoch_transfer that allows malicious RDP servers to crash clients by sending unvalidated OutputBufferSize values. Attackers can send a TS_URB_ISOCH_TRANSFER IN-direction request with OutputBufferSize above INT32_MAX over URBDRC, triggering an assertion in libusb_udev_isoch_transfer that terminates the client.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
可达断言
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-109240
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-109240
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-109240 (2)
Same Patch Batch · FreeRDP · 2026-10-12 · 18 CVEs total
| CVE-2026-109242 | 7.1 HIGH | FreeRDP before 3.0.0 and 3.6.0 before 3.32.0 Uninitialized Heap Disclosure via Progressive |
| CVE-2026-109255 | 6.8 MEDIUM | FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license_check_stream_length |
| CVE-2026-109245 | 6.8 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Improper Certificate Validation in freerdp_http_request |
| CVE-2026-109244 | 6.6 MEDIUM | FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert |
| CVE-2026-109250 | 6.6 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Heap Buffer Overflow via PKCS#11 collect_keys() |
| CVE-2026-109248 | 6.5 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via WinPR Clipboard cFileName |
| CVE-2026-109246 | 6.5 MEDIUM | FreeRDP before 3.32.0 Shadow Server Divide-by-Zero via Frame Acknowledge PDU |
| CVE-2026-109257 | 5.9 MEDIUM | FreeRDP before 3.32.0 Double Free via NSCodec plane growth failure |
| CVE-2026-109254 | 5.9 MEDIUM | FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Disconnect Path |
| CVE-2026-109249 | 5.5 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Heap Out-of-Bounds Read via Remote Assistance File Parsing |
| CVE-2026-109253 | 5.3 MEDIUM | FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds Read |
| CVE-2026-109251 | 5.3 MEDIUM | FreeRDP before 3.32.0 Out-of-Bounds Write via MS-RDPEGT Video Geometry |
| CVE-2026-109252 | 5.3 MEDIUM | FreeRDP from 3.9.0 before 3.32.0 RDPEAR NULL Pointer Dereference via KERB_RPC_INTERNAL_NAM |
| CVE-2026-109256 | 5.3 MEDIUM | FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR PNG Conversion |
| CVE-2026-109243 | 4.4 MEDIUM | FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File |
| CVE-2026-109241 | 3.1 LOW | FreeRDP before 3.32.0 NULL Dereference in Video Redirection Channel |
| CVE-2026-109247 | 3.1 LOW | FreeRDP before 3.32.0 Path Traversal via Clipboard cFileName |
IV. Related Vulnerabilities
Same product: FreeRDP
-
CVE-2026-109257
FreeRDP before 3.32.0 Double Free via NSCodec plane growth f -
CVE-2026-109256
FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR -
CVE-2026-109255
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license -
CVE-2026-109254
FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Discon -
CVE-2026-109253
FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds
Same vendor: FreeRDP
-
CVE-2026-109257
FreeRDP before 3.32.0 Double Free via NSCodec plane growth f -
CVE-2026-109256
FreeRDP 3.10.0 through 3.32.2 Heap Buffer Overflow in WinPR -
CVE-2026-109255
FreeRDP 3.0.0 before 3.32.0 heap buffer overflow via license -
CVE-2026-109253
FreeRDP 3.9.0 before 3.32.0 RDPEAR NDR Scalar Out-of-Bounds -
CVE-2026-109254
FreeRDP 2.1.0 before 3.32.0 Use-After-Free via rdpsnd Discon
Same weakness: CWE-617
-
CVE-2026-109363
Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 -
CVE-2026-109349
gix-pack before 0.75.0 Reachable Assertion DoS via Pack Vers -
CVE-2026-109350
Gitoxide gix-pack before 0.75.0 Denial of Service via OFS_DE -
CVE-2026-39453
Red Lion Controls N-Tron 700 Series Reachable Assertion -
CVE-2026-102916
Reachable assertion in illumos bhyve REP string instruction
V. Comments for CVE-2026-109240
No comments yet