FreeRDP versions 2.3.0 through 3.31.x contain an infinite loop flaw in the http_chunked_read routine that is triggered by malformed chunked responses sent by an RD Gateway. When the gateway sends a partial chunk‑size line or footer and then ends the TLS session, the client repeatedly performs zero‑byte reads and never exits the loop. This results in the client’s decoder thread becoming permanently blocked, effectively denying legitimate use of the remote desktop session. The weakness is identified as unchecked loop iteration, which is CWE‑835.

The affected product is the FreeRDP open‑source RDP client, specifically releases from version 2.3.0 up to 3.31.x. An attacker can exploit the issue by acting as a malicious RD Gateway that the client relies on to establish a remote desktop connection.

The vulnerability has a CVSS score of 7.1, indicating a high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that while the flaw is significant, it may not yet have public exploitation evidence. The likely attack vector is remote; an attacker must be able to position themselves as the RD Gateway that the client connects to. If a FreeRDP client is used in an environment where connections to untrusted RD Gateways are possible, the risk of service interruption is elevated. The absence of an immediate exploit makes the threat moderated but actionable.