FreeRDP’s bitmap_cache_put function contains an out‑of‑bounds read/write due to an off‑by‑one boundary check. An attacker controlling an RDP server can send a CACHE_BITMAP_ORDER packet with cacheId equal to maxCells, bypassing the guard and writing to an array element past the allocated bounds. This can cause application crashes or unpredictable behavior. The flaw is identified as CWE-787. The description does not mention any further consequences beyond the memory corruption impact.

The vulnerability affects the FreeRDP client implementation prior to release 3.24.0. Any system running FreeRDP 3.23.x or earlier is vulnerable. The CPE string confirms the product is freerdp:freerdp. Versions 3.24.0 or later are not affected.

The CVSS v3.1 score is 5.3, indicating moderate severity. The EPSS probability is reported as less than 1 %, suggesting a low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to act as a malicious RDP server that the client trusts; thus the vector is client‑side and depends on the client connecting to an untrusted server. No evidence of active exploitation is documented, so the risk remains theoretical based on the conditions described.