FreeRDP, a free implementation of the Remote Desktop Protocol, contains a heap‑buffer‑overflow flaw in the drive_process_irp_read function. The vulnerability arises when a server‑controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory. Based on the description, it is inferred that an attacker who can supply such an oversized read length could overwrite vital heap structures and potentially execute arbitrary code. The flaw is categorized as CWE‑122 and can lead to corruption of adjacent memory structures, potentially enabling remote code execution.

All releases of FreeRDP before version 3.20.1 are vulnerable. The advisory confirms that the issue was fixed in the 3.20.1 release. Any installation that relies on a prior version, regardless of operating system or deployment scenario, should be considered affected.

The CVSS score of 6.8 indicates moderate severity, while the EPSS score of < 1 % suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog, implying no known widespread attacks. The likely attack vector is remote, requiring an attacker to gain an RDP session that employs remote drive redirection. By crafting a read request with an oversized length, an attacker could trigger the heap overflow and potentially execute code on the host. Because the exploit requires the attacker to control the read length, the opportunity is limited, but the condition is present and not mitigated without patching.