The vulnerability originates from a byte underflow in the progressive codec quantization routine of FreeRDP, causing an undefined shift operation that triggers an astronomic 80‑billion‑iteration loop. This loop consumes CPU resources and renders the RDP client unresponsive, resulting in a denial‑of‑service condition. The flaw does not provide code execution or data exposure, but it can degrade availability of the affected system.

FreeRDP, the open‑source Remote Desktop Protocol client, is impacted. All releases before version 3.24.2 contain the flaw; the patch was applied in version 3.24.2 and later.

The CVSS score of 6.5 indicates a moderate severity, while an EPSS score below 1% shows a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need to send a crafted RDP packet to the vulnerable client in order to trigger the CPU‑bound loop. This does not grant remote code execution or compromise confidentiality, but it can exhaust system resources and interrupt remote sessions.