The flaw permits any unauthenticated host on the network to send a specially crafted CredSSP TSRequest that omits negoTokens. When processed by the NLA‑enabled shadow server, the request triggers a fatal WINPR_ASSERT and aborts the server process. Because no credentials are required, a single malicious packet can crash the service, rendering it unavailable to legitimate users. The vulnerability does not expose or alter data; its impact is strictly on availability.

FreeRDP before version 3.32.2 is affected. All installations that enable NLA shadowing and process CredSSP TSRequests are vulnerable. The product family, FreeRDP:FreeRDP, is the only scope identified.

The CVSS base score of 8.7 places the vulnerability in the High impact range, indicating that crash of the server would have substantial operational consequences. The EPSS score is not available, yet the lack of authentication and the trivial format of the exploit suggest it is realistically exploitable in a network environment. The flaw is not yet in the CISA KEV catalogue, but the combination of a high severity rating and unauthenticated network access warrants immediate attention.