An uncontrolled resource allocation flaw in FreeRDP versions 3.20.1 through 3.31.x allows an attacker to send oversized drive read requests, causing the client to allocate up to 4 GiB of zeroed memory on 64‑bit builds or an under‑reserved buffer on 32‑bit builds. The impact is denial of service; the vulnerability is classified as CWE‑770.

All FreeRDP client installations using 3.20.1 up to, but not including, 3.32.0 on any operating system where the vulnerability is present. This includes 64‑bit and 32‑bit builds that enable drive redirection during an RDP session.

The CVSS score of 7.1 indicates a moderate to high severity risk. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector involves an adversary acting as a malicious RDP server that initiates a connection with a vulnerable client and sends IRP_MJ_READ requests with a Length value of 0xffffffff. Whoever can provide a connection to the client can trigger the memory exhaustion and cause a denial of service. The exploitation requires network access to the client but does not rely on user interaction beyond establishing the RDP session.