FreeRDP before version 3.32.0 contains a divide‑by‑zero bug in the shadow server client handling. The server stores the frame identifier from a client’s Frame Acknowledge PDU without performing a bounds check. When an authenticated client acknowledges a frame identifier one greater than the last frame transmitted, the shadow encoder’s frame creation routine divides by zero, causing a SIGFPE. The result is that the shadow server process terminates and all connected viewers are disconnected. This constitutes an active denial of service.

The affected product is the FreeRDP project, specifically the freerdp-shadow-cli component of FreeRDP. All releases prior to 3.32.0 are impacted—any deployment of FreeRDP 3.31.x or earlier that uses the shadow client API is vulnerable.

The CVSS score of 7.1 indicates a high severity vulnerability. The EPSS score is < 1%, approximately 0.3%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to possess valid authentication credentials to the shadow server. Once authenticated, the attacker can send a crafted Frame Acknowledge PDU to trigger the divide‑by‑zero, leading to service disruption. Given the lack of public exploitation data at this time, the likelihood of immediate exploitation remains uncertain but the impact if exploited is significant.