CVE-2026-33952

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.24.2, an unvalidated auth_length field read from the network triggers a WINPR_ASSERT() failure in rts_read_auth_verifier_no_checks(), causing any FreeRDP client connecting through a malicious RDP Gateway to crash with SIGABRT. This is a pre-authentication denial of service affecting all FreeRDP clients using RPC-over-HTTP gateway transport. The assertion is active in default release builds (WITH_VERBOSE_WINPR_ASSERT=ON). This issue has been patched in version 3.24.2.

• CWE-617

• https://github.com/FreeRDP/FreeRDP/commit/4ac0b6467d371a1ad47c1f751c5b305e4c068adbPatch
• https://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-4v4p-9v5x-hc93Exploit, Mitigation, Patch, Vendor Advisory

Published

Mar 30, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33947jq is a command-line JSON processor. In versions 1.8.1 and b…5.5
• CVE-2026-33948jq is a command-line JSON processor. Commits before 6374ae0b…5.3
• CVE-2026-33949Tina is a headless content management system. Prior to versi…8.1
• CVE-2026-3395A flaw has been found in MaxSite CMS up to 109.1. This impac…9.8
• CVE-2026-33950Signal K Server is a server application that runs on a centr…9.4
• CVE-2026-33951Signal K Server is a server application that runs on a centr…7.5
• CVE-2026-33953LinkAce is a self-hosted archive to collect website links. V…8.5
• CVE-2026-33954LinkAce is a self-hosted archive to collect website links. I…6.5
• CVE-2026-33955Notesnook is a note-taking app. Prior to version 3.3.11 on W…8.6
• CVE-2026-3396WCAPF – WooCommerce Ajax Product Filter plugin is vulnerable…7.5
• CVE-2026-33975Twenty is an open source CRM built with NestJS (Node.js). In…8.3
• CVE-2026-33976Notesnook is a note-taking app. Prior to version 3.3.11 on W…9.6