FreeRDP releases older than 3.32.1 on Windows contain a heap out‑of‑bounds read in the client_cli_present_gateway_message function, triggered by a byte count passed as a wide‑character printf precision. A malicious RD Gateway able to send pre‑authentication consent or service messages can make the client read twice the buffer size, causing sensitive heap memory to be leaked or the client to crash. This leads to potential data exposure or denial of service, affecting the confidentiality and availability of the affected system.

The vulnerability impacts all versions of FreeRDP released prior to 3.32.1 running on Windows platforms. The affected product is FreeRDP:FreeRDP, as identified by its CPE string. No specific sub‑version ranges are listed beyond the cut‑off at 3.32.1.

The CVSS score of 6.9 indicates a moderate severity, with the risk primarily of information disclosure and crash. The EPSS score of less than 1% suggests a very low likelihood of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. A likely attack path requires a malicious RD Gateway that the vulnerable client connects to; once the Gateway sends the crafted consent or service message, the out‑of‑bounds read can be triggered. No additional exploitation prerequisites or elevated privileges are required beyond the ability to communicate with the client through an RD Gateway.