FreeRDP versions earlier than 3.32.2 contain an integer wrap in the gdi_CreateSurface routine when processing an RDPGFX CREATE_SURFACE PDU. The product of the supplied width and height values is not validated, allowing a malicious RDP server to send a PDU with dimensions 32766 × 32766. On 32‑bit builds this triggers a heap buffer overflow that can corrupt heap memory, while on 64‑bit builds the integer wrap results in an allocation of roughly 4 GiB, leading to a denial of service.

The vulnerability affects the FreeRDP client for all platforms on which it is compiled against versions prior to 3.32.2. The affected product is the FreeRDP client bundle, and the known version range is any release before 3.32.2 for both 32‑bit and 64‑bit architectures.

The CVSS score of 7.1 indicates a high severity impact. The EPSS score is not available, but the vulnerability is not yet listed in CISA’s KEV catalog. The likely attack vector is remote; a compromised or malicious RDP server can send crafted CREATE_SURFACE messages to an unsuspecting client over the network. The exploitation requires no local privilege escalation and can be performed against any unmanaged RDP client exposed to untrusted servers.