FreeRDP versions from 3.9.0 up to but not including 3.32.0 contain a memory read beyond the bounds of a buffer in the RDPEAR NDR scalar readers. The code checks the value length before consuming alignment padding, but a malicious or compromised RDP server can craft unaligned RDPEAR payloads that trigger an over‑read. This can cause the client process to crash, resulting in a denial‑of‑service condition. The weakness corresponds to CWE‑125. Affected Systems: The issue impacts the FreeRDP client software produced by the FreeRDP project. Any instance of FreeRDP between release 3.9.0 and 3.31.x that employs Remote Credential Guard and accepts RDPEAR messages is vulnerable. Users must verify that their installations fall within this version range and that Remote Credential Guard is enabled, as that determines whether the exploit pathway is viable. Risk and Exploitability: The CVSS score of 6 indicates a moderate severity. No EPSS score is available, so the probability of exploitation is unknown; however, the vulnerability is remotely exploitable over an RDP connection from an untrusted server. It is not listed in the CISA KEV catalog, which suggests no widespread public exploits have been reported. Given the nature of the flaw—an out‑of‑bounds read leading to a crash—the primary impact is availability; there is no evidence of privilege escalation or arbitrary code execution.

FreeRDP from the FreeRDP project between releases 3.9.0 and before 3.32.0 are affected.

The vulnerability can be triggered by a remote RDP server that sends crafted RDPEAR payloads, such as CreateApReqAuthenticatorReq messages, to a client using Remote Credential Guard. Because the flaw leads to a crash rather than code execution, the threat landscape is limited to denial‑of‑service attacks. The lack of an EPSS score means the exact exploitation likelihood is unknown, but the remote trigger over a network connection remains feasible.