A buffer dimension desynchronization occurs in the H.264 YUV processing routine of FreeRDP. During reallocations the width and height fields are updated before the memory allocation loop completes; if a memory allocation fails, the function exits early while the dimensions have already been inflated, resulting in a heap out‑of‑bounds write. This memory corruption can undermine integrity and, in certain contexts, may allow an attacker to execute arbitrary code. The weakness aligns with CWE‑122 and CWE‑131.

FreeRDP implementations prior to version 3.24.2 are affected, including 3.24.1 and earlier releases. The vendor is FreeRDP.

The CVSS score of 7.5 indicates high severity. The vulnerability is not listed in the CISA KEV catalog. It is inferred that a remote attacker who can initiate an RDP session may send a crafted YUV stream to trigger the fault. If successfully exploited, the attacker could corrupt the client or server memory, potentially leading to privilege escalation or remote code execution.