FreeRDP 3.0.0-beta4 through version 3.32.0 contains a nullable pointer dereference in the arm_handle_request_ok function. When an ARM endpoint returns an HTTP 200 response with an empty body, the client passes a NULL pointer to the strnlen routine, causing the process to terminate. This flaw results in a crash of the connecting client, leading to a denial of service scenario but does not provide an attacker with code execution or elevated privileges.

The vulnerability affects the FreeRDP project and specifically the FreeRDP client implementation. All releases from 3.0.0‑beta4 up to but not including 3.32.0 are impacted.

The CVSS score of 6.0 indicates a moderate risk level. The EPSS score is not provided, and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Likely attack vectors involve an attacker who has control over or can compel a trusted ARM gateway to deliver a zero‑length HTTP 200 body. This requires the attacker to influence or compromise the gateway rather than directly communicating with the FreeRDP client. The crash is deterministic once the response is received, making exploitation straightforward for an attacker in this position, but the need to control the gateway reduces the likelihood of widespread exploitation.