FreeRDP is susceptible to a heap buffer overflow when the URBDRC client fails to perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values, causing an out‑of‑bounds read in libusb_udev_complete_msconfig_setup. The vulnerability is a classic out‑of‑bounds memory read (CWE‑125/129). An attacker controlling the RDP server can supply crafted descriptors that lead the client to access memory beyond its intended buffer, potentially exposing sensitive data or crashing the client. The impact is limited to confidentiality compromise or client disruption rather than broad system compromise.

The flaw exists in all FreeRDP releases prior to version 3.20.1. Users running any of those earlier releases are affected until they upgrade to 3.20.1 or newer, which contains the necessary bounds checks and fixes the overflow.

The CVSS score of 5.6 indicates moderate severity, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild, confirmed by the lack of listing in the CISA KEV catalog. The vulnerability requires an attacker to interact with the URBDRC client via Remote Desktop Protocol, so the most likely attack vector is network‑based intrusion from a malicious RDP server or a compromised host within the same network. Given the remote nature and the memory‑reading impact, an attacker could harvest data from the client heap but would not gain code execution or privilege escalation on the client system.