The vulnerability in FreeRDP occurs in the xf_rail_server_execute_result function, where the global error_code_names array is indexed with an unchecked execResult value sent from the RDP server. Because the array only contains seven elements, an execResult value of 7 or higher causes an out‑of‑bounds read. This allows the server to leak arbitrary client memory contents to the attacker, potentially exposing sensitive data. The flaw is a classic buffer read error (CWE‑125) and does not permit remote code execution but can compromise confidentiality.

All FreeRDP releases prior to version 3.23.0 are affected. The fix is included in FreeRDP 3.23.0 and later.

The CVSS base score of 5.5 indicates moderate impact, and the EPSS score of less than 1% suggests a very low probability of current exploitation. The vulnerability requires a remote RDP server to send a crafted execResult value. No commercial exploitation campaigns are currently known, and the flaw is not listed in CISA’s KEV catalog. Administrators should treat the risk as moderate but action-oriented.