FreeRDP's client code contains a heap‑buffer‑overflow in the audin_process_formats function. When an RDP server sends a malformed AUDIN format list, the function reuses the formats_count callback value across multiple PDUs and writes past the newly allocated formats array. This corrupts control data and causes the client to crash, and could potentially allow an attacker to overwrite memory arbitrarily. The vulnerability is mitigated in version 3.20.1 and before that any remote server may trigger the crash or exploit memory corruption.

All installations of the FreeRDP client before version 3.20.1 are susceptible to the flaw. This includes default builds distributed by the FreeRDP project as well as any custom builds that embed the same library. The issue affects the client side of the Remote Desktop Protocol implementation.

With a CVSS score of 6.8 the risk is considered medium. The EPSS score indicates that the probability of exploitation is under 1 %. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation reports have been publicly documented. An attacker could trigger the overflow by sending a specially crafted AUDIN PDU from a remote RDP server, making the attack vector network‑based. Defensive measures should prioritize patching, and administrators should monitor for unexpected application crashes on RDP sessions.