FreeRDP versions 3.14.1 through 3.31.9 contain an integer underflow in the WinPR BMP writer. A malicious Remote Desktop Protocol clipboard peer can send a crafted 1‑bit‑per‑pixel BMP image via the CF_DIB or CF_DIBV5 format. The mismatch in stride calculation causes the library to pass an excessively large value (SIZE_MAX - 3) to the Stream_Zero routine, leading to an out‑of‑bounds write or a crash of the client. Consequently, the vulnerability can result in memory corruption and a denial‑of‑service condition for any user running the affected client.

The flaw affects the FreeRDP client for the release series from 3.14.1 up to, but not including, 3.32.0. The product identifier is FreeRDP:FreeRDP, and no operating‑system information is supplied in the advisory, so the scope across platforms remains unspecified.

The CVSS score of 7.2 indicates a high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, so public exploitation data is scarce. The likely attack vector is remote: an attacker must have a Remote Desktop session with clipboard redirection enabled to send the crafted image. This limits exposure to sessions where clipboard mirroring is permitted, but the exploitation can lead to immediate client crashes or unpredictable memory corruption.