FreeRDP versions 2.0.0 through 3.31.x allow an unbounded reassembly of static virtual channel data because the WTSProcessChannelData function does not enforce cumulative fragment limits. When an authenticated client repeatedly sends channel fragments without setting the LAST flag, the server allocates memory for each fragment and never releases it, eventually exhausting available RAM. This can lead to memory exhaustion and potential service disruption or crash, effectively denying service to legitimate users. No remote code execution is described, but the denial of service impact is significant. The likely attack vector is through an authenticated Remote Desktop Protocol session; an attacker who can authenticate to the server can trigger the exhaustion by sending a large number of channel fragments.

FreeRDP releases from 2.0.0 through 3.31.x are affected; the vulnerability exists in the WTSProcessChannelData handling of static virtual channel fragments, and no version information beyond the CNA list is available.

The CVSS score of 7.1 indicates a high severity. The EPSS score of < 1% suggests a very low probability of exploitation. The lack of listed exploits in the KEV catalog indicates no confirmed widespread use yet. An authenticated attacker who has obtained or guessed valid credentials can launch the exploitation via a standard RDP connection, sending a stream of fragments to chew up memory. Existing mitigations could filter or reject excessive channel fragments, but the only definitive remediation is the CNA‑provided patch.