FreeRDP before version 3.32.0 contains a heap buffer overflow in the persistent_cache_read_entry_v3 routine. A malicious persistent cache file that supplies oversized width and height values causes the size calculation in persist_cache_get_data to wrap around, creating an undersized buffer. The subsequent fread call then overflows this buffer, corrupting heap memory and allowing an attacker to potentially execute arbitrary code or destabilize the application.

All installations of FreeRDP running any pre‑3.32.0 release are affected. The vendor notes that the issue existed throughout the 3.32.0 release line, and no other product variants are mentioned.

The vulnerability carries a CVSS score of 7, indicating high severity. The EPSS score is below 1%, suggesting a very low probability of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is local; a user or process with write permission to the persistent cache directory can supply a crafted cache file, triggering the overflow and potentially leading to memory corruption or execution of malicious code.