FreeRDP versions through 3.32.1 are vulnerable to a heap out‑of‑bounds write triggered by the RDPGFX client’s HashTable_GetKeys function. The issue arises when the delete_surface callback truncates surface hash keys to 16 bits, causing the surface table to become inconsistent. A malicious or man‑in‑the‑middle RDP server can exploit this by creating a surfaceId of 0xFFFF, closing the RDPGFX channel, sending repeated DELETESURFACE PDUs, and then sending ENDFRAME or RESETGRAPHICS PDUs, which cause a write past the allocated key array. This memory corruption can lead to arbitrary code execution within the client process, compromising confidentiality, integrity, and availability of the machine that runs FreeRDP.

The affected product is FreeRDP, specifically all releases up to and including 3.32.1. There is no further vendor or version granularity listed beyond the overall product name.

The CVSS score of 8.7 signals a high severity vulnerability, and the EPSS score is not available, but the lack of a KEV listing does not diminish the risk. The vulnerability requires a malicious or compromised RDP server; therefore, the attack vector is remote via an RDP session. An attacker who controls the RDP server can potentially alter memory of the client and execute arbitrary code, making this a critical threat to any environment where untrusted RDP servers are connected to the client.