FreeRDP releases prior to version 3.32.0 suffer a heap buffer overflow caused by an integer wrap‑around in the bitmap size calculation within persistent_cache_read_entry_v2. An attacker who can supply a crafted persistent cache v2 file with oversized width and height fields can trigger a mismatch in entry size accounting and a fixed 16 KiB read, corrupting heap memory and potentially crashing the client or executing code in the context of the user.

The vulnerability affects FreeRDP FreeRDP versions earlier than 3.32.0, regardless of operating system, as the flaw resides in the core cache parsing code.

With a CVSS score of 7, the attack is considered high severity but local in scope. Because the flaw is triggered by a malformed cache file, an attacker must have write access to the directory where FreeRDP stores its persistent cache. No remote exploit is described, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score is < 1%, indicating a very low likelihood of exploitation.