FreeRDP versions between 3.9.0 and 3.31.999 contain a NULL pointer dereference in the RDPEAR NDR reader. A malicious server can send a CreateApReqAuthenticatorReq packet with the NameCount field set to two or more, causing the client to truncate the KERB_RPC_INTERNAL_NAME data and dereference a null pointer during cleanup, which results in the client process terminating. The flaw does not provide code execution or data disclosure; its impact is strictly the denial of service for the client application.

The affected product is FreeRDP (FreeRDP:FreeRDP). All installations of FreeRDP from version 3.9.0 up to but excluding 3.32.0 are impacted. Any client or service that loads the vulnerable FreeRDP library on these versions is at risk, regardless of the host operating system.

The CVSS score is 6, indicating moderate severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is remote: an adversary controlling a FreeRDP server can send the crafted packet over a legitimate RDPEAR channel, triggering the crash on the client. The exploit requires no special privileges and can be performed repeatedly, making the vulnerability suitable for denial‑of‑service attacks against individual users or inadvertently causing widespread client outages in environments that rely on FreeRDP. Because it is a client‑side crash, it does not affect the server or any other remote host.