The integer underflow occurs in the update_read_cache_bitmap_order function of FreeRDP's Core Library prior to version 3.24.0, as reported in the vendor’s advisory. The flaw involves an arithmetic error that can lead to incorrect memory handling, potentially causing a crash or service disruption on the affected system. The associated CWE identifiers (190, 191, 400, 789) indicate integer underflow, signed/unsigned conversion errors, resource exhaustion, and memory allocation failures.

All installations of FreeRDP (FreeRDP:FreeRDP) running any version earlier than 3.24.0 are affected. The CVE advisory specifically mentions that the issue is fixed in 3.24.0, implying that versions prior to that release are vulnerable.

The CVSS score is 3.1, classifying the vulnerability as low severity. The EPSS score is below 1%, and it is not listed in the CISA KEV catalog, indicating a low likelihood of widespread exploitation. The attack vector is likely remote network‑based, as the flaw is triggered when a client sends bitmap order data to the server. Although exploitation requires a crafted RDP session, the low severity and low exploitation probability suggest that the immediate risk to thoroughly unpatched systems is modest, but prompt patching is still recommended to eliminate any risk of denial of service.