The flaw is a heap buffer overflow in the transport_default_read_pdu function, which processes partial Early User Authorization (EUA) reads during the PROTOCOL_HYBRID_EX CredSSP protocol. A malicious RDP server can opportunistically split the four‑byte EUA result into a sequence of unaligned reads so that the internal stream pointer advances beyond the 16 KiB buffer allocated for the PDU. The resulting out‑of‑bounds write corrupts adjacent heap memory and causes the client to crash or become unresponsive. This attack does not provide privilege escalation or code execution, but it reliably brings the client to a denial‑of‑service state.

The affected systems are all FreeRDP client implementations shipped before version 3.32.2. Both the official CNA and the vulnerability advisory list the problem as a heap buffer overflow; no platform‑specific variants are mentioned.

The CVSS score of 7.2 indicates a high‑severity flaw that can be exploited remotely. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that the attacker can trigger the overflow by sending a malicious RDP server that splits the Early User Authorization result into sub‑reads, causing the stream pointer to advance beyond the 16 KiB buffer. The attacker does not need privileged access to the client machine; simply connecting to a compromised or intentionally malicious RDP host is sufficient. This results in a denial‑of‑service attack that crashes or hangs the client but does not provide code execution or elevated privileges.