FreeRDP before version 3.32.0 stores signed geometry origin values unchecked in an unsigned video surface coordinate, causing the blit clamp in gdiVideoShowSurface() to wrap in 32-bit arithmetic and skip bounds checking. A malicious RDP server can therefore send a negative topLevelLeft value while negotiating the video channel, resulting in an out-of-bounds write of decoded H.264 picture data or a client abort. The flaw does not guarantee executable code flow but can corrupt memory and potentially crash the client, which is classified under both CWE-129 and CWE-787.

All users running FreeRDP versions prior to 3.32.0 who connect with the /video option are vulnerable. The affected product is FreeRDP released by the FreeRDP community. No additional vendor or platform data is available.

The CVSS score of 6 indicates a medium severity. The EPSS score of <1% and the vulnerability not being listed in CISA’s KEV catalog suggest limited known exploitation. The likely attack vector is remote: a malicious RDP server can target any client that connects using the video channel by sending a negative topLevelLeft value in the session negotiation, potentially leading to memory corruption or a client crash.