A heap out‑of‑bounds read exists in the Android client of FreeRDP prior to version 3.32.1. This issue allows a malicious remote desktop protocol server to supply excessively large mappedWidth and mappedHeight values in an RDPGFX_MAP_SURFACE_TO_WINDOW_PDU, causing the android_UpdateWindowFromSurface routine to copy memory beyond the bounds of a surface buffer. The resulting read may expose sensitive data or lead to a crash, impacting confidentiality and stability of the client application.

The vulnerability affects the Android client of the FreeRDP project. All installations using any FreeRDP version older than 3.32.1 are impacted.

The CVSS score of 6.9 indicates a moderate severity, but the EPSS score of less than 1% suggests that exploitation is currently unlikely. The vulnerability is not listed as a Known Exploited Vulnerability by CISA. Attackers can exploit it remotely by connecting to the affected Android client, transmitting a specially crafted PDU. Without patching, attackers could read arbitrary memory or cause a denial of service.