FreeRDP versions 3.18.0 through 3.31.x contain a heap-based out‑of‑bounds write in the function freerdp_interruptible_get_line. The routine truncates the buffer to 32 bytes while still using a write offset derived from a pre‑filled suggested username. If an ARM routing service supplies a redirectedUsername that exceeds this limit, the write overruns the allocated heap memory, corrupting data and causing the client to crash when the user attempts to enter credentials. This flaw does not allow arbitrary code execution but enables users to be denied service.

The flaw impacts the FreeRDP client on ARM architectures in releases prior to 3.32.0, specifically versions 3.18.0–3.31.x. Any deployment that employs an ARM‑based routing service and installs one of these versions is vulnerable.

The CVSS score is 6.0, indicating medium severity. EPSS data is unavailable, so no current estimate of exploitation probability exists. The vulnerability is not listed in the CISA KEV catalog. An attacker would need to control or compromise the ARM routing service to supply an overly long redirectedUsername that triggers the out‑of‑bounds write. The consequence is a client crash and denial of service; there is no impact on system confidentiality or integrity.