FreeRDP is a free Remote Desktop Protocol client that contains an out‑of‑bounds read in the RDPGFX channel. A malicious RDP server can send a crafted WIRE_TO_SURFACE_2 PDU with a bitmapDataLength larger than the actual data, causing the client to read uninitialized heap memory. This can leak sensitive data or cause the client to crash. The weakness is identified as buffer overread and improper bounds checking.

The vulnerability affects FreeRDP versions on the 2.x branch before 2.11.8 and on the 3.x branch before 3.23.0. These releases are used by multiple operating systems that rely on FreeRDP for remote desktop access.

The CVSS score of 4.3 marks this flaw as moderate severity, and the EPSS score of less than 1% indicates a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to run a malicious RDP server to which a user connects. Once connected, the attacker can trigger the out‑of‑bounds read and obtain information or crash the client. The attack is remote, requires no local privileges, and relies on the client accepting the crafted packet.