A heap out‑of‑bounds read in FreeRDP’s ClearCodec glyph cache desynchronization allows an attacker to read arbitrary neighboring heap memory and render that data to the screen. The consequence is that sensitive information may be exposed to the attacker through the display. This type of weakness matches known CWE‑125 and CWE‑131 conditions.

The flaw exists in all FreeRDP releases prior to version 3.24.2. Users running an older instance of the Open‑Source Remote Desktop Protocol client are affected.

The vulnerability is assigned a CVSS score of 5.9, reflecting moderate severity. No EPSS score is currently available and the issue is not listed in the CISA KEV catalog. Exploitation would require the attacker to establish an RDP session that triggers the glyph cache rendering path; once engaged, the attacker can view arbitrary data that may have been leaked, representing a moderate risk to confidentiality in exposed environments.