A client‑side heap buffer overflow exists in FreeRDP versions prior to 3.21.0. The flaw is triggered when a malicious RDP server sends specially crafted band coordinates, allowing the ClearCodec path to write past the end of the destination surface buffer. This memory corruption causes the client application to crash, resulting in a denial‑of‑service condition. While the description notes that the overflow could in theory enable arbitrary code execution depending on the heap layout and allocator behaviour, this outcome is unconfirmed and remains a potential risk rather than a known exploit.

All installations of FreeRDP running a version older than 3.21.0 are affected. This includes clients deployed on Windows, Linux, and other operating systems that use FreeRDP to connect to remote desktop hosts. The vulnerability impacts any environment where the client may initiate connections to external RDP servers.

The CVSS score of 7.7 indicates a high severity, but the EPSS score of less than 1 % suggests that widespread exploitation is unlikely at present. The flaw is not listed in the CISA KEV catalog. An attacker must control an RDP server that a vulnerable client connects to; the attack vector therefore requires the client to initiate a connection to a malicious endpoint. Even though code‑execution is theoretically possible, the predominant confirmed impact is a denial‑of‑service through client crashes, and the overall risk depends on the likelihood of client–server interactions with untrusted hosts.