The vulnerability is an out‑of‑bounds heap write in the server’s NTLM authentication path. A malicious AUTHENTICATE_MESSAGE with a backward session‑key offset and an unexpected MIC offset causes the server to write 16 zero bytes beyond the allocated buffer, corrupting memory. The weakness is classified as CWE‑787.

All releases of the FreeRDP server from version 2.0.0 through 3.31.x are affected. The product is the open‑space Remote Desktop Protocol implementation distributed under the FreeRDP project.

The CVSS base score of 8.3 signals high severity, and the issue can be exploited remotely without authentication by an attacker who sends a specially crafted AUTHENTICATE_MESSAGE. Because the EPSS score is not available and the CVE is not listed in CISA’s KEV catalog, the likelihood of exploitation remains unclear, but the remote unauthenticated nature presents a significant potential for memory corruption that could lead to denial of service in any host running a vulnerable FreeRDP instance.