Technical impact
FreeRDP before version 3.29.0 contains a flaw in the RDPEI server channel handler that does not validate the maximum PDU body length before allocating memory. A malicious RDP client can send a header-only RDPEI message with a very large declared body length, which forces the server to allocate excessive memory and can cause the process to crash or become unresponsive. The resulting denial of service disables legitimate Remote Desktop connections to the affected server.
Affected Systems
The vulnerability affects the FreeRDP project, specifically all releases of the FreeRDP client that run a server component before update version 3.29.0. Users deploying older FreeRDP binaries for Windows Remote Desktop or virtual desktop delivery should verify their install falls into this range.
Risk and Exploitability
With a CVSS score of 8.7, the weakness is considered high severity. The EPSS score is not provided, so the exploitation likelihood is uncertain from that metric, but the vulnerability is remotely exploitable by any RDP client capable of crafting malformed RDPEI PDUs. The CISA KEV catalog does not list this CVE, indicating no known active exploits at the time of assessment. Nonetheless, the potential for serious service disruption warrants immediate attention and remediation.
