The vulnerability arises because FreeRDP fails to verify that the region widths of AVC444 and AVC444v2 data streams are even before converting YUV444. An attacker can send a region rectangle with an odd width during RDPGFX AVC444 negotiation, causing the client to hit an assertion and abort. The result is a denial of service where the connection is terminated, affecting client availability.

Affected products include the FreeRDP client, versions 3.11.0 through 3.31.x. The issue is present in all releases prior to 3.32.0. Users running these versions on any platform that supports the RDP GFX AVC444 codec are potentially exposed.

The CVSS score is 7.1, indicating a high severity threat level. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a malicious or compromised RDP server that sends an in‑bounds region rectangle with an odd width after AVC444 negotiation. By exploiting this flaw, an attacker can disrupt client availability without needing initial authentication, assuming the RDP session is established. Monitoring for abrupt client termination and mitigating via updates are recommended.