CyberRota Analysis
AI-GeneratedFreeRDP versions prior to 3.31.0 are vulnerable to a denial-of-service attack due to improper validation of the OutputBufferSize in the URBDRC control-transfer request path. An attacker operating a malicious RDP server can exploit this flaw by sending a control-transfer request with an oversized OutputBufferSize, leading to a client process crash. Organizations utilizing FreeRDP should prioritize patching to mitigate the risk of service disruption.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
FreeRDP before 3.31.0 contains a denial-of-service vulnerability in the URBDRC control-transfer request path that fails to validate OutputBufferSize before forwarding to the libusb backend. A malicious RDP server can send a control-transfer request with OutputBufferSize set to 65536, triggering a reachable assertion that terminates the client process.