FreeRDP versions 3.0.0-beta1 through 3.31.x do not enforce cumulative or absolute limits when reassembling RDPDR channel fragments in the proxy. An attacker can send a first fragment followed by many continuation fragments without a terminating last fragment, causing per‑session heap streams to grow in proportion to the traffic. This unbounded memory retention can exhaust the proxy’s memory and cause the RDP service to become unavailable.

FreeRDP (FreeRDP:FreeRDP) for versions 3.0.0-beta1 up to, but not including, 3.32.0.

The vulnerability has a CVSS score of 8.2, indicating high severity. EPSS is not available and the issue is not listed in the CISA KEV catalog. Because the flaw is triggered by sending specially crafted RDP traffic, an attacker only needs the ability to initiate an RDP session with the vulnerable proxy; no authentication or elevated privileges are required. If exploited, the unbounded memory growth can trigger a denial of service affecting all users connecting through the affected proxy.