The flaw occurs in the ecam_encoder_compress_h264 component of FreeRDP where it trusts server‑controlled video dimensions without validating the source buffer size. During sws_scale processing, this leads to an out‑of‑bounds read, allowing an attacker to read beyond the intended buffer boundaries. The CVSS score of 8.7 reflects the high severity of the vulnerability, indicating a risk of sensitive data leakage and the possibility of further exploitation, such as memory corruption or remote code execution, depending on the attacker’s skill set.

All releases of FreeRDP prior to version 3.22.0 are affected. Any system running the FreeRDP client with a Remote Desktop Protocol connection could be impacted if the client receives maliciously crafted dimension values from an RDP server.

The EPSS score is below 1%, suggesting a low likelihood of widespread exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, the CVSS score remains high, meaning that if an attacker successfully delivers the crafted server payload, they could cause the client to read arbitrary memory. The attack path likely involves establishing an RDP session with an attacker‑controlled server that supplies out‑of‑range dimensions, triggering the buffer overrun during the encode step.