A heap-buffer-overflow occurs in the FreeRDP client’s gdi_SurfaceToSurface path when the destination rectangle clamping does not match the actual copy size. A malicious RDP server can send crafted data that triggers an overflow on the client side, leading to a crash that provides denial‑of‑service. Depending on the memory allocator and surrounding heap layout, the overflow may also result in heap corruption and the opportunity to execute arbitrary code on the client. The weakness is classified as CWE‑122.

All FreeRDP clients prior to version 3.21.0 are affected. The issue manifests in the free implementation of the Remote Desktop Protocol provided by the vendor FreeRDP.

The CVSS score of 7.7 rates the vulnerability as high severity. The EPSS score is below 1 %, indicating that, at the time of assessment, exploitation is thought to be rare. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a connection to a malicious RDP server and relies on the client performing an unsafe memory copy. If an attacker can control heap layout, the risk of remote code execution rises, whereas in typical deployments the primary risk is denial of service.