FreeRDP clients released before version 3.32.0 have a heap out‑of‑bounds write in the conversion functions general_LumaToYUV444 and general_ChromaV2ToYUV444. A malicious RDP server can send specially forged AVC444 or AVC444v2 frames that contain odd‑height region rectangles terminating at the surface height. This causes the client to write beyond the U/V planes, corrupting heap memory and allowing an attacker to potentially execute arbitrary code on the client with the privileges of the user running the FreeRDP process.

All installations of FreeRDP older than 3.32.0 that use the default YUV conversion path are vulnerable. This includes Windows, Linux, and macOS clients that have not been upgraded. Any system that connects to a remote desktop session served by an attacker‑controlled RDP server may be exposed.

The flaw carries a CVSS score of 8.7, classifying it as high severity. The EPSS score is indicated as less than 1 %, suggesting that the probability of exploitation observed in the wild is low. It is not listed in CISA’s KEV catalog. However, the attack vector is remote and the vulnerability is client‑side: an adversary in control of an RDP server can trigger the exploit from network distance, potentially compromising the client’s process and executing code under the user’s privileges.