FreeRDP versions 3.0.0 through 3.31.x contain an out‑of‑bounds read in the Windows RAIL client. When a malicious RDP server sends a WINDOW_ORDER_FIELD_TITLE update that is not NUL terminated, the client’s wf_rail_window_common routine passes a malformed string to SetWindowTextW, causing a heap over‑read. This may expose memory contents to the client process, corrupt window titles, or crash the application. The weakness is classified as a classic out‑of‑bounds read, CWE‑125.

The vulnerability affects the FreeRDP client distributed by the FreeRDP project. All build versions from 3.0.0 up to, but not including, 3.32.0 are vulnerable.

The CVSS score of 6.3 indicates moderate impact. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, suggesting low to moderate likelihood of exploitation in the wild. Exploitation requires a remote attacker who can act as an RDP server and send a specially crafted, non‑NUL‑terminated window title to a client using RAIL. The attack reads memory, which may lead to information disclosure or a denial of service by crashing the client, but does not provide code execution.