FreeRDP (versions 2.0.0 through 3.31.x) contains a memory exhaustion flaw in the function wts_read_drdynvc_data_first. When an authenticated client sends a seven‑byte DATA_FIRST message that declares an excessively large 32‑bit length, the server allocates a correspondingly large block of zeroed resident memory. The unchecked allocation can cause the server to run out of memory, leading to a denial of service.

The vulnerability impacts FreeRDP 2.0.0 up to 3.31.x, all builds before the 3.32.0 release. These include the FreeRDP open‑source Remote Desktop Protocol implementation on any platform that hosts the vulnerable server binary.

Even though EPSS data is unavailable and the issue is not in CISA’s KEV catalog, the flaw’s CVSS score of 7.1 denotes high severity. An attacker who can authenticate to the remote desktop service can immediately trigger the exhaustion by sending the crafted message. The lack of publicly known exploits does not reduce the risk, because a simple form‑flood can bring a Remote Desktop Service to a halt.