An authenticated RDP client can advertise a DVI ADPCM format in which the block alignment and channel count produce a zero denominator during the server’s frame‑size calculation. When the server subsequently takes frames modulo this zero value, a floating‑point exception is raised and the server‑side sound channel process exits. The effect is a refused connection or a server restart, causing disruption of legitimate remote desktop sessions. The flaw arises from improper validation of format parameters and is classified as CWE‑369.

FreeRDP implementations prior to version 3.28.0 are susceptible. The vulnerability is present in all builds that compile the server sound channel code without the patch introduced in the 3.28.0 release.

The CVSS score of 6.5 indicates moderate severity. The EPSS score is unavailable, so the likelihood of exploitation in the wild is unknown, and the vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated RDP access and knowledge of the specific ADPCM parameters; once a client sends the malicious packet the denial occurs immediately, making the attack straightforward for a determined intruder.