A NULL pointer dereference in the rdp_write_logon_info_v2 function within FreeRDP can be triggered by a malicious RDP server that sends a specially crafted LogonInfoV2 PDU. The attacker can cause the client to crash by setting either the cbDomain or cbUserName field length to zero. This flaw does not provide code execution but results in a denial of service by terminating the client, representing a classic null pointer dereference weakness (CWE‑476).

All releases of FreeRDP prior to version 3.22.0 are affected. The patch that resolves the issue is included in the 3.22.0 release, so any client using an earlier version of the open‑source Remote Desktop Protocol implementation is vulnerable. An attacker only needs to pose as an RDP server and send the malformed PDU; no local privileges on the client are required.

The CVSS score of 6.9 indicates a moderate severity with an impact on availability. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog, meaning no actively circulating zero‑day exploit is known. However, because the flaw can be triggered remotely by any server to which the user connects, the potential for opportunistic denial of service remains realistic. An attacker could impersonate a legitimate RDP server to cause client crashes, or use the flaw as part of a larger attack chain, though no immediate elevation of privileges is afforded.