FreeRDP, a free Remote Desktop Protocol implementation, contains an out‑of‑bounds write in the RLE planar decode routine prior to version 3.23.0. The routine writes pixel data without verifying that destination coordinates remain within the allocated buffer, allowing an attacker to overflow the temporary buffer by up to 132,096 bytes. When the temporary buffer is overwritten, a neighboring NSC_CONTEXT structure’s decode function pointer can be corrupted, enabling control‑flow hijacking. This flaw provides attackers with the potential to execute arbitrary code on a FreeRDP client during a normal RDP session.

All FreeRDP installations with a version older than 3.23.0 are affected. The vulnerability exists in the core FreeRDP client code and applies to any deployment that accepts RDP connections from external servers. Users relying on older versions such as 3.22.x or earlier are at risk, while versions 3.23.0 and later contain the fix.

The CVSS score of 8.8 denotes high severity, but the EPSS score is less than 1%, indicating a low probability of widespread exploitation. The vulnerability is not yet listed in the NIST KEV catalog, suggesting no confirmed active exploits at the time of analysis. Exploitation requires an attacker to act as an RDP server and serve crafted RLE data to a FreeRDP client, which is feasible for any external host with the ability to initiate an RDP connection. If successfully exploited, the attacker can gain arbitrary code execution on the client, potentially compromising confidentiality, integrity, and availability of the system.