FreeRDP's ClearCodec decompress routine reads glyphData without validating the destination rectangle. This missing bounds check can cause an out‑of‑bounds write to the heap when the server sends crafted RDPGFX surface updates. The exploit can crash the client (Denial of Service) and, in some memory layouts, may corrupt heap metadata, giving an attacker the possibility to execute arbitrary code.

The flaw affects the FreeRDP project, specifically the FreeRDP client implementing the Remote Desktop Protocol. All releases prior to version 3.21.0 are vulnerable; the issue was fixed in the 3.21.0 release.

The vulnerability is assessed with a CVSS score of 7.7, indicating high severity. The EPSS rating is less than 1%, suggesting very low current exploit probability. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to control an RDP server capable of sending malformed surface updates to a FreeRDP client. Because the flaw resides on the client side, a local or remote attacker could trigger the overflow and potentially gain code execution if the heap layout is favorable.