An unvalidated auth_length field in the network stream causes a WINPR_ASSERT failure in the rts_read_auth_verifier_no_checks function before authentication is completed. When a FreeRDP client connects through a malicious RDP Gateway that sends a crafted packet, the client aborts with SIGABRT, effectively denying service. The vulnerability is associated with an assertion reached on unexpected input and is classified as a reachable assertion weakness, aligned with CWE-130 and CWE-617. The primary impact is the interruption of the Remote Desktop session, resulting in availability loss for users relying on FreeRDP clients employing this transport.

All versions of the FreeRDP client prior to 3.24.2 are affected. The issue manifests when the client uses the RPC-over-HTTP gateway transport. No other products or vendors are mentioned as impacted.

The CVSS score of 6 indicates a moderate impact, while the EPSS score of less than 1% suggests it is unlikely to be exploited in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to control or supply a malicious RDP Gateway that transmits a crafted authentication packet to the client. This attack vector is inferred from the described behavior, as the denial occurs before authentication completes. The risk is therefore moderate severity with low probability, but the ability to disrupt service may be critical in high availability environments.