FreeRDP versions earlier than 3.32.2 contain an out‑of‑bounds write in the proxy component. The bug occurs when a client declares fewer than five bitmap cache v2 cell caches during the Confirm Active negotiation. The parsing routine only rejects values greater than five, but the bitmap cache cell array is later accessed at fixed indices 0 through 4. This mismatch can lead to a heap write past the bounds of a buffer. An attacker exploiting this flaw can corrupt heap metadata, potentially causing the proxy process to crash, or leak heap data that may contain sensitive information from the backend Connection. The impact therefore includes denial of service and possible confidentiality compromise. The weakness is a classic memory corruption flaw and is identified as CWE‑787.

All installations of FreeRDP that run a proxy and use a version earlier than 3.32.2 are vulnerable. The affected component is the proxy module that processes bitmap cache v2 capabilities. No specific OS or platform restrictions are noted; the flaw is present in all configurations where a proxy is enabled.

The CVSS score of 9.3 classifies this as a critical vulnerability with an extremely high potential impact. The EPSS score is not available, so the current probability of exploitation is unknown, but the lack of a mitigated environment means any client that can connect to the proxy could potentially trigger the flaw. The vulnerability is not listed in the CISA KEV catalog, but its severity and the fact that it can be triggered remotely by a client make it a high‑priority risk. The most likely attack vector is a malicious client establishing a connection to a FreeRDP proxy and sending a Confirm Active message that advertises fewer than five cell caches in order to cause the out‑of‑bounds write.