FreeRDP, a free implementation of the Remote Desktop Protocol, contains a client‑side heap buffer overflow in the YUV‑to‑RGB conversion routine avc420_yuv_to_rgb. The overflow arises because the function clamp() validates only vertical coordinates, omitting left/right bounds checks on regionRects. A malicious server can send a WIRE_TO_SURFACE_PDU_1 with an AVC420 codec and a rectangle whose left coordinate is far outside the surface width, causing avc420_yuv_to_rgb to compute a destination pointer that is far past the allocated surface buffer. This memory corruption can lead to application crashes or potentially arbitrary code execution, representing a medium severity vulnerability (CWE‑787).

The vulnerability exists in all FreeRDP client releases prior to version 3.24.0. Any user running FreeRDP as the client for remote desktop sessions is potentially impacted when connecting to a server that can supply the crafted PDU.

The CVSS base score is 5.3, reflecting a moderate impact. The EPSS score is below 1%, indicating a low probability of current exploitation in the wild, and the vulnerability has not been listed in CISA’s KEV catalog. Exploitation requires a malicious RDP server capable of sending the specific PDU, so exposure is limited to connections with untrusted servers. Nonetheless, the lack of bounds checks creates a clear opportunity for memory corruption, warranting prompt attention.