FreeRDP, an open‑source implementation of the Remote Desktop Protocol, has a heap‑based out‑of‑bounds read that occurs 24 bytes before a memory allocation in the winpr_aligned_offset_recalloc function. The vulnerability is a buffer error that can expose data residing adjacent in heap memory, effectively leaking sensitive information. This weakness is classified as CWE‑125, which describes a heap‑based buffer over‑read where data is read beyond the intended bounds.

The flaw affects the FreeRDP project, specifically all releases prior to version 3.24.2. It is tied to the winpr library component used for memory management. Any system running a vulnerable instance of the FreeRDP client or server should be considered at risk until an updated version is deployed. No additional vendor or product variants are listed beyond the core FreeRDP codebase.

The CVSS base score of 7.1 indicates a high severity issue, but EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known exploitation at present. The description does not specify how the read can be triggered, so we cannot confirm the attack vector. However, given that FreeRDP is used to handle incoming RDP connections, the most likely path for exploitation would involve a specially crafted RDP packet, a conclusion inferred from the context rather than explicit statement. Until further evidence emerges, treating the vulnerability as a high‑risk threat is prudent.