FreeRDP parses slow‑path input events without verifying that the six‑byte body of an unknown message type fits within the declared packet length. When a client sends a truncated unknown input event, the server triggers a WinPR stream assertion failure which leads to a process abort, causing a denial of service. The vulnerability is a CWE‑617 input validation failure that compromises availability for the RDP server and may cascade to the host if the crashed process is critical.

All FreeRDP installations running an RDP server component with versions 3.0.0 through 3.32.1 are affected. The vulnerability applies to any deployment that uses the default WinPR assertion handling and exposes an RDP session to remote clients.

The CVSS base score of 8.7 indicates a high severity condition. EPSS data are unavailable and the issue is not listed in the CISA KEV catalog, so the likelihood of exploitation is uncertain. The vulnerability requires an active RDP session from a remote client to send the malformed event, making the attack vector a remote software/network‑based attack that only requires client reachability. The impact is loss of availability for the RDP service and potential cessation of dependent host processes if the crashed process is essential.