FreeRDP versions before 3.32.2 have a denial of service vulnerability in the NLA-enabled shadow server. This occurs when a CredSSP TSRequest omits negoTokens, allowing unauthenticated attackers to send a crafted seven-byte TSRequest that triggers a fatal assertion and crashes the server process.