FreeRDP versions before 3.24.2 contain a flaw in the H.264 decoding routine. In yuv_ensure_buffer() the decoder updates the stream width and height before allocating the YUV data buffer. If a call to winpr_aligned_recalloc() fails, the function returns FALSE but the width/height values have already been inflated. This causes the buffer allocation logic to run with values larger than the allocated memory, resulting in a heap out-of-bounds write.

The vulnerability affects FreeRDP releases prior to 3.24.2, specifically the H.264 decoding module of the client. Users running these versions are exposed to the described buffer overflow.

The CVSS base score of 7.5 indicates high severity, while the EPSS score of less than 1% and the absence from the CISA KEV catalog suggest a relatively low likelihood of exploitation in the wild. The likely attack vector, inferred from the description, is an attacker sending a malicious or malformed H.264 stream within a Remote Desktop session that triggers the allocation failure and results in memory corruption, which could impact data integrity and availability.