The vulnerability resides in the parsing of FastGlyph data on the FreeRDP client. The code uses the cbData length without confirming that the minimum size implied by the glyph dimensions is satisfied. An attacker controlling a remote RDP server can send a malformed glyph packet that overflows a client‑side heap buffer. The result is a client crash, which is a denial‑of‑service condition. The weakness is a classic heap buffer overflow (CWE‑122).

FreeRDP version 3.20.x and earlier are vulnerable. The issue is present in the main FreeRDP library used by many open‑source remote‑desktop clients. Version 3.21.0 and later contain the patch. Any system running a FreeRDP client that connects to an attacker‑controlled RDP server and accepts FastGlyph packets is affected.

The entry carries a CVSS score of 5.5, indicating moderate severity. Because the EPSS score is below 1%, the likelihood of this vulnerability being exploited in the wild is low, and it is not listed in the CISA KEV catalog. The attack requires the client to accept a malicious glyph packet from a remote server, which usually means the user must initiate a remote desktop session. The overflow leads only to a crash, not arbitrary code execution, making it a local or network‑limited denial of service.