FreeRDP versions from 3.0.0 up to but not including 3.32.0 contain a null pointer dereference in the rdpsnd channel. When a server sends a fragment that sets CHANNEL_FLAG_LAST without CHANNEL_FLAG_FIRST, the client dereferences a null pointer, crashing the session. The resulting crash is a denial‑of‑service condition, preventing the client from functioning until restarted. This weakness is a classic example of CWE‑476, a null pointer reference.

The vulnerability affects the FreeRDP client (FreeRDP). Any installation of the FreeRDP client built from source or provided as a binary in versions 3.0.0 through 3.31.x is impacted. The advisory does not list any additional vendor or product variations beyond the core FreeRDP client.

The CVSS score of 7.1 indicates a moderate to high severity for the potential denial of service to the client. EPSS data is not available, so the current probability of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog. An attacker would need the ability to act as an RDP server to send the malformed rdpsnd PDU, so the attack vector is remote, requiring direct or indirect control over an RDP session to the vulnerable client. The effect is limited to crashing the client; it does not provide code execution or data disclosure.