A buffer overread exists in the function `freerdp_image_copy_from_icon_data()` in FreeRDP before version 3.23.0. When a client processes a crafted RDP Window Icon (TS_ICON_INFO) packet, the function reads beyond the intended bounds. The description does not describe a direct code execution vector, and thus it is inferred—based on the information provided—that the vulnerability is limited to information disclosure. The memory overread may expose sensitive data that is resident in the client’s address space, constituting an information‑disclosure vulnerability. The weakness is classified under CWE‑126 and CWE‑805.

The unpatched vulnerability affects all releases of the FreeRDP project before version 3.23.0. It is present in the official FreeRDP distribution and in any environment that uses a client built from an older source tree. The affected product is specifically named FreeRDP:FreeRDP and all versions earlier than 3.23.0.

The CVSS score of 5.5 indicates moderate severity, and the EPSS score of less than one percent suggests a very low likelihood of exploitation in the wild at present. The flaw is reachable over the network: an attacker who controls or intercepts an RDP session can supply malicious icon data. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread exploitation. Consequently, while the risk of exploitation is low, the possibility of accidental data leakage to a connected client or attack‑via‑man‑in‑the‑middle scenario exists.