FreeRDP libraries from version 2.0.0 through just before 3.32.0 contain a null pointer dereference that lets a malicious RDP server send out‑of‑lifecycle serial IRPs to a client. When an attacker issues IRP_MJ_READ or IRP_MJ_WRITE before a serial channel is created or after it is closed, the client’s CommReadFile or CommWriteFile functions dereference a null handle and crash, resulting in a denial of service for the user.

The affected product is FreeRDP, version 2.0.0 through 3.31.x inclusive. Clients running these versions on Linux that use serial redirection are vulnerable. The vulnerability stems from the FreeRDP Linux serial redirection implementation.

The CVSS score of 7.1 classifies the issue as medium severity. Because EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, there is no evidence of widespread exploitation, but the attack vector is remote and requires the attacker to control or impersonate an RDP server that a client connects to. If an attacker can establish such a connection, they can cause the client to crash, interrupt sessions, and deny service. The risk is therefore moderate for environments that use Linux serial redirection and do not restrict connections to trusted servers.