FreeRDP versions 2.0.0 up to 3.32.1 contain an out‑of‑bounds read in the GSM610/WAV49 audio decoder. By negotiating the GSM610 codec on the rdpsnd channel, a malicious RDP server can send truncated GSM610 frames that are shorter than a 33‑ or 32‑byte WAV49 frame, causing the client to read beyond the bounds of the audio buffer. The read can lead to a client crash or the disclosure of data residing after the buffer, establishing a moderate‑severity vulnerability with a CVSS score of 5.3.

Vulnerable releases of the FreeRDP project, specifically version 2.0.0 through just before 3.32.2, are affected. Any installation of FreeRDP that does not include the patch released in 3.32.2 or later is at risk.

The vulnerability can be exercised remotely by any entity that can establish an RDP session with the client and negotiate the GSM610 codec. No local privileges are required, and the attacker can trigger the out‑of‑bounds read by sending a simple malformed frame, which may cause a crash or leak hidden data. EPSS for this CVE is not provided, and it is not currently listed in the CISA KEV catalog, but the moderate CVSS score indicates an elevated risk for denial of service or information leakage. The attack path is straightforward: connect to the client, select the codec, send a truncated frame, and observe the resulting crash or data exposure.