The vulnerability exists in FreeRDP’s persistent cache component. When a cache entry is read, the bmpSize counter is advanced before a safe reallocation is performed. If that reallocation fails, bmpSize becomes inflated while the data pointer still references a smaller buffer, so subsequent writes overrun the heap. This is a classic heap buffer overflow (CWE‑122) and also involves an incorrect buffer size calculation (CWE‑131). The result is unpredictable memory corruption that can cause application crashes or, in the worst case, allow an attacker to overwrite sensitive data if the attacker can influence the cache entry data.

All builds of the FreeRDP client and library released before version 3.24.2 are affected. This includes the core libfreerdp/cache/persistent.c file used by any FreeRDP installation that enables persistent caching. The patch was introduced in the 3.24.2 release, so any installation of 3.24.2 or later is considered safe.

The CVSS base score of 7.1 indicates a high severity. The EPSS probability is below 1%, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, an attacker would need to supply a crafted RDP session that causes the persistent cache read to trigger a failed reallocation. This could be achieved by connecting to a malicious RDP server that deliberately sends malformed cache data, which is the most probable exploit scenario inferred from the nature of the bug.