FreeRDP 3.27.1 through 3.31.x contains a NULL pointer dereference in the update_read_cache_bitmap_v3_order() function. When a remote server sends a Cache Bitmap V3 order during connection setup, the client attempts to access an uninitialized bitmap cache if the CBR3_DO_NOT_CACHE flag is set. This results in a crash of the RDP client, effectively causing a denial‑of‑service condition. The flaw is identified as CWE‑476, a Null Pointer Dereference.

Versions of FreeRDP from 3.27.1 up to, but not including, 3.32.0 are impacted. The vulnerability manifests when the non‑default Bitmap Cache V3 feature is enabled by supplying the /cache:codec:<codec> switch (e.g., rfx, nsc, jpeg). Clients lacking this option or running the default configuration are not affected. Update to 3.32.0 or later to remove the bug.

The CVSS score of 7.1 classifies this as high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known public exploitation. However, exploitation only requires the ability to connect to the target via the RDP protocol, and a malicious or compromised RDP server can send the offending order during login to crash the client on any machine that has the vulnerable feature enabled.