FreeRDP 3.0.0 before 3.32.2 Proxy Memory Exhaustion via DVC Reassembly

Summary

FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.

Remediation

1. Inventory every FreeRDP FreeRDP deployment, including staging.
2. Upgrade FreeRDP FreeRDP to 3.32.2.
3. Confirm the running version after the upgrade.

References

• Advisoryhttps://github.com/FreeRDP/FreeRDP/security/advisories/GHSA-m7xq-5f7v-hjvw
• Advisoryhttps://www.vulncheck.com/advisories/freerdp-3.0.0-before-3.32.2-proxy-memory-exhaustion-via-dvc-reassembly