FreeRDP clients before version 3.32.0 expose a NULL pointer dereference within the websocket transport when a zero‑length ping frame is received. The client processes the frame, passes a null stream to a close routine, and triggers an assertion failure that terminates the application. A malicious gateway that the client trusts can send such ping frames, causing the client to crash and denying service to the user. The vulnerability is a classic null dereference (CWE-476) and an assertion violation (CWE-617).

All embodiments of FreeRDP earlier than 3.32.0, regardless of operating system, are affected. This includes every free or open‑source deployment that has not applied the 3.32.0 release or a later compatible patch.

The CVSS score of 6.9 indicates medium severity. EPSS < 1% shows a very low probability of exploitation at present, and the flaw is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is a gateway that forwards WebSocket traffic to the client; the attacker does not need elevated local privileges. The exploitation path requires only the ability to deliver a crafted zero‑length ping to the client, making the flaw remotely exploitable on any system that accepts untrusted WebSocket connections.