The resource retention flaw lies in drive_process_irp_create. When the function registers an opened local file before checking allocation size, a failure in allocation leaves the file object and operating‑system handle in the drive dictionary. A malicious RDP server can trigger this by sending an IRP_MJ_CREATE with AllocationSize set to the maximum 64‑bit value, causing the seek to fail while still leaking the handle until drive teardown. The vulnerability thus enables a denial‑of‑service through exhaustion of system file descriptors and handles, consistent with CWE‑775.

All FreeRDP clients released before version 3.32.0 are affected. The flaw exists in the FreeRDP 3.13.0 through the 3.31.x series and is fixed in 3.32.0 and later releases.

The CVSS score of 5.3 classifies the flaw as moderate, and the EPSS score is not available. Because the attack requires a malicious RDP server that can send a specially crafted IRP_MJ_CREATE to a client with drive redirection enabled, the exploit is remote but limited to environments where the client accepts drive redirection. The flaw is not listed in CISA's KEV catalog. While the exploitation might lead to resource exhaustion or a denial of service, the lack of an EPSS rating and the moderate CVSS suggest that the risk is moderate but tangible, especially in networks with many concurrent RDP sessions.