FreeRDP’s progressive decompression engine contains a bug where a mismatched quantization value is used as a shift exponent. The small wrapped value (247) underflows to zero, triggering undefined behavior that creates a loop of roughly 80 billion iterations. The excess CPU usage can exhaust system resources and render the host or a session unresponsive. No escalation to arbitrary code execution or data exposure is documented; the impact is purely an availability compromise.

All FreeRDP installations whose version is earlier than 3.24.2 are affected. The issue was remedied in the 3.24.2 release. If a deployment still uses an older release, it remains vulnerable.

The official CVSS score of 6.5 indicates moderate severity, and no EPSS data is available. The vulnerability is not listed in the CISA KEV catalog. It can be exploited by an attacker who sends a specially crafted RDP data stream that triggers the vulnerable decompression path, so the attack vector is remote, network‑based via the target’s Remote Desktop service.