A heap‑based buffer overflow occurs in FreeRDP when decompressing RLE‑encoded planar bitmaps. The vulnerability allows a malicious RDP server to send crafted image data that overflows the client’s heap buffer, potentially causing a crash or corrupting surrounding heap memory. The overflow is classified as CWE‑122 and can lead to denial of service, with a risk of code execution depending on the heap allocator’s behavior.

All FreeRDP installations using versions prior to 3.21.0 are affected. The vendor product is FreeRDP, and the affected software is the “freerdp_bitmap_decompress_planar” routine. No other products or versions are listed as impacted.

The vulnerability has a CVSS score of 7.7, indicating a high level of risk. The EPSS score is below 1 %, suggesting a low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves a remote RDP server sending malformed RLE data to an untrusted client. If successfully exploited, an attacker could crash the client or potentially execute arbitrary code, depending on the heap layout and allocator used.