The vulnerability is a heap buffer over‑read in the DynvcTrackerHandleCreateBack function of the freerdp‑proxy component. Attackers can send a crafted CREATE_REQUEST_PDU where the channel name string lacks a terminating NUL byte. This causes an unbounded snprintf read that copies data beyond the intended buffer, enabling the proxy to read arbitrary heap memory. The data read may leak sensitive information into proxy logs or cause a crash, leading to denial of service of the proxy process.

Affected vendors and products: FreeRDP, specifically the 3.17.1 release through any revision before 3.32.0. This includes all FreeRDP 3.x versions from 3.17.1 up to the 3.31.x series. Users running the proxy component of these versions are impacted.

The CVSS score of 6.9 indicates moderate severity. No EPSS information is available, so the relative exploitation probability cannot be quantified, and the vulnerability is not listed in CISA's KEV catalog. Attackers need to control a backend RDP server that connects to the vulnerable proxy. By sending the malformed channel name, they can read beyond the buffer boundary, potentially leaking information and destabilizing the proxy. Mitigation focuses on updating or restricting access to the proxy.