A heap buffer overflow exists in the ClearCodec component of FreeRDP, triggered when the resize_vbar_entry function incorrectly updates an internal pixel buffer size before reallocating memory. If the realloc fails, the buffer size is inflated while the pixel data pointer still references the original, smaller memory block. Subsequent writes of attacker‑controlled pixel data then overflow this undersized buffer, corrupting heap memory. This flaw corresponds to unresolved memory corruption weaknesses (CWE‑122) and inflated array size errors (CWE‑131). The overflow can potentially allow an attacker to execute arbitrary code on a host running a vulnerable instance of FreeRDP, compromising confidentiality, integrity, and availability of the system.

The vulnerability affects the FreeRDP project’s FreeRDP library. Versions prior to 3.24.2 are susceptible; the issue was remediated in 3.24.2 and later releases. All deployments that utilize the affected FreeRDP component—whether as a client or server—are at risk if they have not applied the patch.

The CVSS score of 7.5 indicates high severity, but the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no documented exploitation. Attackers would most likely target an RDP session where the vulnerable FreeRDP instance processes image data; the exploit requires the attacker to supply carefully crafted pixel data and may need elevated privileges if host restrictions are in place. Given the high potential impact, organizations should treat the flaw as significant even though the expected exploitation likelihood remains low.