FreeRDP contains a global buffer overflow in its Base64 decoding routine because signedness of plain char is implementation-defined. Non-ASCII values may bypass a range check and index a global table out of bounds, corrupting memory. An attacker could exploit this to crash or potentially hijack execution on affected systems.

The vulnerability affects FreeRDP releases older than 3.20.1, running on architectures such as Arm and AArch64 where char is unsigned. Users of FreeRDP prior to the 3.20.1 release are exposed regardless of operating system.

The CVSS score is 5.6, indicating a moderate severity. EPSS is below 1 %, so widespread exploitation is unlikely at present, and the issue is not listed in CISA’s KEV catalog. The likely attack vector is remote, through an RDP session that processes Base64-encoded data, such as credentials or other parameters.