CVE-2026-33952: 
NixOS vulnerability analysis and mitigation

CVE-2026-33952 is a pre-authentication denial of service vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol. An unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks() (rts.c:282), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. All FreeRDP versions prior to 3.24.2 are affected, including all clients using RPC-over-HTTP gateway transport (xfreerdp, SDL client, and third-party applications using libfreerdp). The vulnerability was published on March 30, 2026, and patched in version 3.24.2. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is classified as CWE-617 (Reachable Assertion) and CWE-130 (Improper Handling of Length Parameter Inconsistency). In libfreerdp/core/gateway/rts.c, both frag_length and auth_length are read directly from the network in rts_read_common_pdu_header() (lines 247–248) with only a minimal check that frag_length >= sizeof(rpcconn_common_hdr_t) (16 bytes); auth_length receives no validation before the assertion WINPR_ASSERT(header->frag_length > header->auth_length + 8) is evaluated. A malicious RDP Gateway can send any RPC PDU (BIND, BIND_ACK, ALTER_CONTEXT, REQUEST, RESPONSE, FAULT, and others — 10+ PDU types in total) with a crafted auth_length value such that auth_length + 8 >= frag_length (e.g., frag_length=60, auth_length=200), triggering abort() in the client process. The assertion is active in default release builds (WITH_VERBOSE_WINPR_ASSERT=ON). A public PoC (poc_assert.c) is included in the GitHub Security Advisory (GitHub Advisory, GitHub Commit).

Successful exploitation results in an immediate crash (SIGABRT/abort()) of the FreeRDP client process, causing a denial of service for any user attempting to connect through a malicious or compromised RDP Gateway. The attack occurs before authentication, meaning no credentials are required from the attacker's side, and any FreeRDP-based client — including xfreerdp, the SDL client, and third-party applications using libfreerdp — is affected. There is no confidentiality or integrity impact; the vulnerability is limited to availability, disrupting remote desktop sessions and potentially blocking users from accessing remote systems (GitHub Advisory).

A minimal proof-of-concept (poc_assert.c) is publicly available in the GitHub Security Advisory, demonstrating the SIGABRT crash via the assertion failure without requiring access to a real FreeRDP client. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.063% (low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Set up a malicious RDP Gateway: Deploy a rogue or compromised RDP Gateway server (RPC-over-HTTP transport) reachable by target FreeRDP clients, or perform a man-in-the-middle attack to intercept gateway connections.
2. Wait for a client connection: A FreeRDP client (xfreerdp, SDL client, or any libfreerdp-based application) initiates a connection through the malicious gateway using RPC-over-HTTP transport.
3. Craft a malicious RPC PDU: Prepare any supported RPC PDU type (e.g., BIND, BIND_ACK, ALTER_CONTEXT, REQUEST, RESPONSE, FAULT, etc.) with a crafted header where auth_length + 8 >= frag_length — for example, frag_length=60 and auth_length=200.
4. Send the malicious PDU: Transmit the crafted PDU to the connecting FreeRDP client during the pre-authentication connection setup phase.
5. Trigger assertion failure: The client's rts_read_auth_verifier_no_checks() function evaluates WINPR_ASSERT(header->frag_length > header->auth_length + 8), which fails, causing abort() and a SIGABRT crash — achieving denial of service without any credentials (GitHub Advisory).

• Logs: FreeRDP client logs showing [FATAL][com.freerdp.winpr.assert] messages referencing winpr_int_assert and the condition (frag_length > auth_length + 8) in rts.c; repeated unexpected client process terminations during gateway connection attempts.
• Process: FreeRDP client process (xfreerdp, sdl-freerdp, or libfreerdp-based app) terminating abruptly with SIGABRT signal during RDP Gateway connection setup, before authentication completes.
• Network: Unusual RPC PDU traffic from an RDP Gateway containing auth_length values disproportionately large relative to frag_length (e.g., auth_length + 8 >= frag_length); connections to unexpected or newly registered RDP Gateway endpoints (GitHub Advisory).

Upgrade FreeRDP to version 3.24.2 or later, which validates auth_length against frag_length before the assertion is reached (fix commit 4ac0b64) (GitHub Commit). For organizations unable to upgrade immediately, restrict RPC-over-HTTP gateway connections to trusted, verified gateways only, and implement network segmentation to limit client exposure to potentially malicious gateways. Additionally, monitor FreeRDP client logs for unexpected SIGABRT crashes as an indicator of exploitation attempts (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked the issue via Bugzilla (#2453223) and published a CVE advisory, rating it medium severity. The vulnerability was reported by researcher "Sebasteuo" and disclosed through the FreeRDP GitHub Security Advisory program by maintainer akallabeth. Coverage appeared on Linux-focused security news outlets including pro-linux.de and linuxcompatible.org, and Tenable released Nessus detection plugins (IDs 303846, 304350, 304936, 312116, 312138). No significant social media controversy or broader industry debate has been observed (Red Hat Bugzilla, GitHub Advisory).