Exposure is limited to systems using FreeRDP in the server role, including projects that embed it as an RDP server such as GNOME Remote Desktop and KDE krdp. These services are not typically enabled by default; affected systems have generally been configured by an administrator to provide remote desktop or remote login access.
No. Client-role FreeRDP is not affected by any of the five reported server-side issues.
Issues 2 through 5 require an authenticated RDP session under normal circumstances. In remote-login modes, issue 1 can bypass authentication to establish an RDP connection that renders the login screen, and three issues were demonstrated as a pre-authentication remote-code-execution chain.
Upgrade to FreeRDP 3.31.0, or apply distribution-provided backports. There is no 3.30.x point release containing these fixes, so deployments on 3.30.0 or earlier require a 3.31.0 rebase or their own backported fixes.