FreeRDP versions 3.0.0 through 3.31.x feature a flaw in the NLA frame parser that can be triggered by an unauthenticated attacker. During the TLS hand‑shake phase, the parse_nla_mode_pdu routine accepts arbitrary byte streams that are not framed with the expected DER SEQUENCE tag 0x30, causing the receive buffer to grow without bound. This uncontrolled resource consumption falls under CWE-400 and results in server memory exhaustion, potentially crashing or severely slowing the RDP service. The vulnerability does not grant code execution or privilege escalation; it simply disrupts availability by exhausting memory.

The affected product is FreeRDP. All releases from version 3.0.0 up to but not including 3.32.0 are impacted. This includes the core library and any applications that embed FreeRDP. The vulnerability is present in the server side component that parses incoming NLA frames, meaning any host that is acting as an RDP server and is publicly reachable could be affected.

The CVSS score of 8.7 classifies this issue as High severity. The EPSS score is < 1%, indicating a very low probability of exploitation. However, because the flaw is remotely exploitable over the standard RDP port and requires no prior authentication, an attacker can attempt the exploit from any network location that can reach the target. The vulnerability is not listed in the CISA KEV catalog, but the lack of a restriction on both remote reachability and authentication elevates the risk. If an attacker succeeds, the server will consume large amounts of memory, likely resulting in service disruption or a crash. The attack path consists of a TLS‑terminated connection followed by a crafted byte stream that bypasses the NLA authentication check. The attacker can therefore trigger the buffer growth before authentication is even performed.