A heap buffer overflow occurs in the FreeRDP’s nsc_process_message() function when it processes SURFACE_BITS_COMMAND messages. As described, the function gdi_surface_bits() is unable to validate the bitmap width and height values supplied by the RDP server, allowing those values to exceed the actual desktop surface dimensions. The unchecked values are used during bitmap decoding and memory operations, resulting in an uncontrolled overflow that can overwrite adjacent heap memory. This vulnerability could enable an attacker to execute arbitrary code or crash the client. Key detail from vendor description: *"This vulnerability is fixed in 3.24.0."*

The issue affects the FreeRDP implementation of the Remote Desktop Protocol up to version 3.23.x and earlier. Any deployment of FreeRDP that processes SURFACE_BITS_COMMAND messages via NSCodec without the 3.24.0 update is vulnerable. The vendor explicitly lists FreeRDP:FreeRDP as the impacted product.

The CVSS score of 9.3 indicates a critical severity, and the EPSS score of less than 1% suggests a low probability of exploitation at present. Though the vulnerability is not listed in the CISA KEV catalog, its nature allows an attacker who controls a malicious RDP server to send crafted bitmap commands over the network, thereby exploiting the unchecked dimensions. Based on the description, it is inferred that the attack vector is remote network traffic. The potential impact includes arbitrary code execution on the affected client system.