FreeRDP’s RDPEAR module contains a heap‑buffer‑overflow flaw in the NDR array reader, where an untrusted element count is accepted without bounds checking. An attacker who can send a crafted packet during a Remote Desktop Protocol session could overwrite memory on the client side, potentially leading to a crash or arbitrary code execution. The weakness is categorized as CWE‑787, a memory corruption issue triggered by improper bounds verification.

All FreeRDP versions earlier than 3.20.1 are affected. The flaw exists specifically in the ndr_read_uint8Array function used by the RDPEAR component of the FreeRDP client. Upgrading to 3.20.1 or later removes the vulnerability by adding necessary bounds checks.

The CVSS score is 6.8, indicating a medium severity. The EPSS score is below 1 %, suggesting a very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require network access to the RDP client; therefore, the likely attack vector is remote via a malicious RDP connection. No confirmed public exploits are available at this time.