FreeRDP 3.0.0 before 3.32.0 includes an integer truncation in license_check_stream_length that allows a malicious RDP server to send a crafted SERVER_LICENSE_REQUEST with an excessively large scopeCount. This bypasses length checks, causing a heap buffer overflow on 32‑bit clients. The out‑of‑bounds write can lead to denial of service or even remote code execution if exploitation succeeds.

The vulnerability affects the FreeRDP client. Versions 3.0.0 through 3.31.999 are vulnerable, while 3.32.0 and newer contain the fix. The issue is triggered on 32‑bit client builds; the effect on 64‑bit binaries is not expressly stated in the description.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of < 1% suggests an extremely low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, attackers can send a crafted SERVER_LICENSE_REQUEST from an untrusted RDP server to a 32‑bit FreeRDP client, requiring network access to the target system. Successful exploitation could terminate the client process or provide code execution if the overflow is leveraged.