FreeRDP clients that communicate with a Remote Desktop Protocol (RDP) gateway over HTTP transport may trigger an assertion failure when an unvalidated authentication length field is read from the network. The failure occurs in the rts_read_auth_verifier_no_checks() routine and causes the client to abort with SIGABRT. Because the crash happens before any authentication succeeds, the attacker can prevent the client from establishing a remote session, resulting in a denial‑of‑service condition for the affected user. The weakness is a flow‑control issue (CWE‑617) that does not directly expose confidential data or compromise server integrity.

All FreeRDP client installations using the RPC‑over‑HTTP gateway transport and running a version earlier than 3.24.2 are affected. The issue has been fixed in FreeRDP 3.24.2 and later releases.

The vulnerability carries a CVSS score of 6.0, indicating medium severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog. The attack can be performed remotely by an adversary who can send a crafted RDP packet to a vulnerable client; no special privileges or local code execution are required beyond network connectivity to the client.