FreeRDP releases before version 3.0.0 and all 3.6.0 releases prior to 3.32.0 allocate a buffer for progressive codec tiles without zero‑initializing it. A malicious RDP server can send a crafted sequence of WBT_TILE_FIRST followed by WBT_TILE_UPGRADE packets that cause the client to read the uninitialized heap memory. The result is that previously used heap data is painted on the client screen, exposing sensitive information to the viewer. In addition, the malformed sequence can abort the client process, leading to a denial‑of‑service condition. The weakness is identified as CWE‑908.

Any FreeRDP deployment running a version earlier than 3.0.0, and any 3.6.0 branch release that is earlier than 3.32.0. These releases lack the memory‑zeroing fix that is present in later 3.0.0 and 3.32.0 and newer builds.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. Although the EPSS score is not reported, the vulnerability can be exploited from any remote RDP server that controls the session, making the attack vector likely network‑based. The vulnerability is not listed in the CISA KEV catalog, so there is no known active exploitation in the wild at this time. Nonetheless, the risk of data exposure combined with the potential for a crash warrants close attention and swift mitigation.