FreeRDP before 3.26.0 contains a heap‑buffer‑overflow vulnerability in the gdi_CacheToSurface function that allows remote attackers to write out‑of‑bounds heap memory. The bug arises because rectangle validation clamps coordinates to UINT16_MAX while copy operations use unclamped cache entry dimensions, enabling malicious RDP servers to trigger large out‑of‑bounds writes that can lead to remote code execution or client crashes.

The affected product is FreeRDP, all installations of which are vulnerable when their version is older than 3.26.0. Users running FreeRDP clients that connect to Remote Desktop Protocol servers on their networks may be impacted.

The CVSS score of 8.6 indicates a high severity vulnerability, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker controlling an RDP server that sends specially crafted rectangle parameters to a FreeRDP client; the attack can be performed remotely over the network if the client is reachable. Given the potential for remote code execution, the risk is significant and the vulnerability should be addressed promptly.