FreeRDP clients that use the GDI surface pipeline are vulnerable to a heap buffer overflow caused by an RDP server that sends an RDPGFX ClearCodec command with an out-of-bounds destination rectangle. The lack of bounds checking in the gdi_SurfaceCommand_ClearCodec handler allows the attacker to write beyond the intended surface data, corrupting a pointer inside the gdiGfxSurface structure. This corruption leads to an indirect function pointer call that an attacker can control, enabling full instruction pointer takeover and arbitrary code execution on the client.

The affected product is FreeRDP, with all releases before version 3.23.0 vulnerable, including the xfreerdp client that utilizes the GDI surface pipeline. No other vendors or product variations are mentioned in the CVE.

The CVSS score of 8.8 indicates a high severity RCE. The EPSS score is less than 1%, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog, implying no known active exploitation yet. However, the vulnerability can be triggered by any RDP server that a client connects to, meaning an attacker only needs to host a malicious RDP server or control an existing one. The demonstration of an exploit harness confirms that remote exploitation is practical, so the risk remains significant if the client connects to an untrusted server.