FreeRDP clients implement the RDP protocol and include a dynamic channel mechanism known as DRDYNVC. In versions 3.0.0 through 3.32.1, the client does not sufficiently validate the Length field of a DATA_FIRST message on a running dynamic channel. An attacker controlling the RDP server can send a Length value up to 4,294,967,295 bytes. The client’s StreamPool_Take reserves that amount of memory before body validation, which can exhaust the client’s memory and cause a crash or denial of service.

FreeRDP FreeRDP is affected. All releases from 3.0.0 up to and including 3.32.1 are vulnerable. Clients running these versions on any operating system that includes the FreeRDP library are impacted.

The vulnerability is rated CVSS 7.1, indicating moderate to high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the exploit remotely by connecting to an RDP client that is a malicious server or by providing a malicious RDP server to a client. The attack vector is network‑based via the RDP protocol, and no special privileges are required on the client side. Successful exploitation would lead to memory exhaustion and a denial of service.