FreeRDP before version 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client. The flaw occurs when rpc_client_recv_fragment writes BIND_ACK and ALTER_CONTEXT_RESP fragments into a persistent PDU stream after verifying only the total capacity, ignoring the remaining space from the current stream position. A malicious or compromised RD Gateway can send crafted RPC fragments with manipulated alloc_hint and frag_length values, allowing an attacker to overwrite client heap memory with controlled data, which can lead to a crash or potentially arbitrary code execution.

The vulnerability affects the FreeRDP project, specifically all builds of the FreeRDP client prior to release 3.32.2. No specific operating system or distribution details are listed, but any deployment of these older FreeRDP versions that connects to an RD Gateway is potentially impacted.

The CVSS score of 8.7 indicates a high severity. The EPSS score is not available, so exploitation likelihood cannot be quantified, and the vulnerability is not listed in CISA KEV. If an RD Gateway can be reached from an attacker-controlled environment, the flaw could be exploited remotely by sending specially crafted RPC fragments, leading to heap corruption, application crashes, or arbitrary code execution in the client process.